800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

Security researchers have uncovered a sprawling npm registry campaign in which nearly 800 malicious packages distribute a cross-platform remote access trojan (RAT) and infostealer targeting Windows, macOS, and Linux systems. Tracked by Sonatype as "Flooding Dropper," the cluster was identified by OpenSourceMalware researcher Paul McCarty, who noted that the packages rely on AI-generated or randomly typo-squatted names rather than recognizable dependency confusion. What sets this campaign apart from prior npm supply chain attacks is its use of a README that instructs developers to manually import the module via require(), bypassing traditional preinstall and postinstall lifecycle hooks that security tools routinely flag.

Once loaded, the package executes a downloader dubbed WEL1DROPPER, which fingerprints the host operating system and CPU architecture before pulling a compatible payload from one of three Cloudflare Workers domains (oob-worker.cf103-070.workers[.]dev, oob-worker.cf102-baf.workers[.]dev, and oob-worker.cf99-9b3.workers[.]dev). If HTTPS retrieval fails, the malware pivots to DNS TXT records on "." The staged TXT responses — between 1 and 2,000 chunks — are concatenated and Base64-decoded into an executable buffer. Researchers investigating these indicators can use a DNS leak test or a WHOIS lookup to audit suspicious domains like sdk.dl.wel1[.]ru, ext.dl.wel1[.]ru, pkg.dl.wel1[.]ru, and net.dl.wel1[.]ru associated with each platform.

The final-stage payload is dropped into a temporary folder and launched as a detached process via /bin/sh on Linux and macOS, or cmd.exe on Windows. The Windows variant patches Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) to evade monitoring, performs sandbox and VM checks, establishes persistence through a Registry Run key and scheduled task, and downloads an encrypted binary (/pkg/update_win.exe). The macOS build mirrors these anti-analysis routines before retrieving /pkg/beacon_mac.bin, falling back to DNS TXT delivery, and persisting via a LaunchAgent. The Linux sample is a UPX-packed ELF binary that fetches auxiliary payloads from a Cloudflare Worker URL. Operators auditing inbound traffic for these indicators are advised to run a port scanner against exposed endpoints and validate TLS configurations with an SSL/TLS checker to identify anomalous Cloudflare Worker subdomains communicating on non-standard ports. Developers should audit npm dependencies immediately, pin package versions, and sandbox any project that instructs manual module loading outside standard installers.