Nearly 800 npm Packages Linked to Cross-Platform RAT and Infostealer Campaign

Security researchers have identified almost 800 packages on the npm registry that appear to be part of a campaign distributing remote-access malware and information-stealing tools to Windows, macOS, and Linux systems.

According to OpenSourceMalware researcher Paul McCarty, the packages use a mixture of typo-squatted, randomly generated, and AI-generated names. Rather than relying on npm lifecycle scripts such as preinstall or postinstall, the packages instruct developers to import them with JavaScript’s require() function, allowing the malicious code to run when the module is loaded.

The initial component, tracked as WEL1DROPPER, determines the host’s operating system and processor architecture before retrieving a matching payload. Its primary download infrastructure uses several Cloudflare Workers. If those requests fail, the malware can use DNS TXT records associated with the domain wel1[.]ru to reconstruct a payload from multiple Base64-encoded fragments.

Platform-specific capabilities

• Windows malware reportedly interferes with ETW and AMSI monitoring, checks for virtualized or sandboxed environments, creates persistence through a Registry Run key and scheduled task, and retrieves an encrypted executable.
• The macOS variant performs anti-analysis checks, establishes a LaunchAgent, and downloads a separate binary, with DNS-based delivery available as a fallback.
• The Linux sample is an UPX-packed ELF executable that can fetch additional components and ultimately deploy Sliver, an open-source command-and-control framework.

Researchers also found a file named lib/telemetry.js. Although it resembles a legitimate analytics library and is not imported by the package’s main entry point, it contains downloader functionality. Analysts believe the oversized file may be intended to obscure the malicious code during cursory reviews.

References to Russian financial and payment companies in the macOS payload could indicate targeting of organizations in that sector. Sonatype, which calls the activity Flooding Dropper, said the operation may represent a continuation of an earlier dependency-confusion campaign known as Moika.

The findings add to a broader wave of malicious activity affecting npm and PyPI, including credential theft, cryptocurrency theft, cloud-secret collection, and CI/CD token harvesting. Researchers have separately warned that some Chrome extensions marketed as productivity or utility tools embed bandwidth-sharing software that turns browsers into remotely controlled web-crawling proxies.