Security researchers have uncovered a massive supply chain attack that flooded the npm registry with nearly 800 malicious packages, each delivering cross-platform remote access trojans and credential-stealing malware to Windows, Mac, and Linux systems. The campaign, dubbed Flooding Dropper by Sonatype, represents one of the largest coordinated poisoning efforts targeting the npm ecosystem.
The packages use what researchers call AI slop-squatting, a technique where randomly generated or AI-produced names mimic legitimate modules to trick developers into installing them. Unlike typical npm supply chain attacks that rely on lifecycle hooks like preinstall or postinstall to run malicious code, these packages use a different approach. Their README files instruct developers to load them using the require() function, which executes the hidden payload directly.
Once loaded, the packages deploy a downloader named WEL1DROPPER that identifies the host operating system and processor architecture before fetching a compatible malware binary from one of three Cloudflare Workers domains. If the HTTPS-based download fails, the malware falls back to a DNS TXT record-based delivery system through the domain wel1.ru, requesting numbered chunks of encoded data that are reassembled into the final payload.
The Windows payload takes extensive measures to evade detection, including patching Event Tracing for Windows and the Antimalware Scan Interface. It establishes persistence through a Registry Run key and a scheduled task before downloading and executing an encrypted secondary payload. The macOS variant performs similar anti-analysis checks before retrieving its payload and setting up a LaunchAgent for persistence.
The Linux payload is a UPX-packed ELF binary that downloads auxiliary modules from a Cloudflare Worker endpoint, ultimately deploying Sliver, an open-source command-and-control framework popular among both red teams and threat actors. The packages also contain a file named telemetry.js that mimics a legitimate analytics SDK but contains the same downloader logic, designed to appear as normal profiling code during casual review.
Researchers at OpenSourceMalware noted the presence of domains linked to Russian financial institutions and mobile payment platforms within the macOS payload, suggesting the campaign may specifically target Russian organizations. The effort appears to be an evolution of a dependency confusion campaign called Moika first observed in April, which had deployed over 250 packages with similar techniques.
The discovery coincides with additional findings from Palo Alto Networks Unit 42, which documented separate npm and PyPI campaigns distributing cryptocurrency stealers, blockchain-based command infrastructure, and Discord token theft tools. Together, the findings underscore the growing sophistication of software supply chain attacks and the increasing use of AI tools to automate the creation of malicious packages at scale.
Sources: The Hacker News, OpenSourceMalware, Sonatype
discussion