Introduction to the npm Registry Threat In a significant escalation of software supply chain attacks, cybersecurity researchers have uncovered a massive campaign involving nearly 800 malicious packages published to the npm registry. This sophisticated operation is designed to distribute cross-platform malware—specifically Remote Access Trojans (RATs) and infostealers—targeting Windows, macOS, and Linux environments. As open-source repositories become prime targets for cybercriminals, developers must remain vigilant against these evolving deployment tactics.

AI-Generated Squatting and Evasion Tactics According to Paul McCarty, a researcher at OpenSourceMalware, the threat actors are utilizing “AI slop squatting” or randomly generated typo-squatting to name these packages. Unlike traditional npm-oriented supply chain attacks that rely on lifecycle hooks like preinstall or postinstall to automatically trigger malicious code, this campaign employs a stealthier approach. The packages include a README file that socially engineers developers into manually loading the malware using the built-in require() function, effectively bypassing standard automated security scanners.

The WEL1DROPPER Downloader and Cloudflare Infrastructure Once executed, the attack initiates a downloader dubbed WEL1DROPPER. This sophisticated script immediately profiles the host operating system and processor architecture to fetch a compatible second-stage payload. The malware initially attempts to pull this payload from one of three compromised Cloudflare Workers hosts. If these HTTPS-based downloads fail, the malware demonstrates remarkable resilience by switching to a fallback mechanism. It connects to a platform-specific domain (such as net.dl.wel1.ru for Windows) and utilizes DNS TXT records to retrieve the payload in Base64-encoded chunks, reconstructing the binary locally.

Platform-Specific Malware Execution The final execution phase is highly tailored to the victim’s operating system. On Windows, the malware patches Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) to blind security monitoring tools, establishes persistence via the Registry, and deploys an encrypted payload. The macOS infection chain mirrors this complexity, actively hunting for analysis artifacts before establishing persistence using a LaunchAgent. On Linux, the payload arrives as a UPX-packed ELF binary that ultimately deploys the open-source Sliver Command-and-Control (C2) framework.

Broader Campaign Context and Developer Security Security experts suspect this campaign is a direct evolution of “Moika,” a dependency confusion attack observed earlier this year. The inclusion of Russian banking domains in the macOS payload suggests financial motives. Furthermore, Palo Alto Networks’ Unit 42 has noted a broader trend of ecosystem abuse, including malicious Chrome extensions marketed as productivity tools that secretly inject hidden iframes to convert user browsers into web crawling proxies. For organizations relying on npm and open-source code, implementing strict dependency auditing and behavioral monitoring is no longer optional—it is a critical requirement.