Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

What it is

The WEL1DROPPER / "Flooding Dropper" campaign (1,033 confirmed npm packages, per OpenSourceMalware co-founder Jenn Gile). Its novelty over the summary: these packages do not use preinstall/postinstall lifecycle hooks. Instead the README instructs the developer to load the package with require() — so the malware only fires when a human follows the docs, sidestepping install-time scanners that watch npm hooks.

How it works

On require(), WEL1DROPPER fingerprints OS and CPU arch, then fetches a matching payload from one of three Cloudflare Workers hosts. If HTTPS fails, it falls back to DNS TXT-record delivery: it requests a TXT record from c.<domain>, parses that as a chunk count (accepted range 1–2,000), requests that many numbered TXT records, concatenates the strings, and Base64-decodes them into a binary. The payload is written to a temp folder and run via /bin/sh (Linux/macOS) or cmd.exe (Windows) as a detached process.

A decoy file lib/telemetry.js carries a duplicate copy of the downloader logic dressed as a telemetry SDK. The package entry point does not import it — it exists purely to add noise and look like analytics during a quick review.

Preconditions / Affected

Developers who install one of these packages and follow the README to require() it. Cross-platform: Windows, macOS, Linux (x64 and ARM64). macOS payloads reference tcsbank[.]ru and cloudpayments[.]ru, suggesting a Russian-financial-institution target set. Assessed as an evolution of the April "Moika" dependency-confusion campaign (~250 packages).

What to do

Block/alert on these indicators the summary does not list:

• Cloudflare Workers C2:
• oob-worker.cf103-070.workers[.]dev
• oob-worker.cf102-baf.workers[.]dev
• oob-worker.cf99-9b3.workers[.]dev
• DNS TXT fallback under wel1[.]ru:
• Linux x64 sdk.dl.wel1[.]ru · Linux ARM64 ext.dl.wel1[.]ru · macOS pkg.dl.wel1[.]ru · Windows net.dl.wel1[.]ru
• Payload artifacts: /pkg/update_win.exe (Windows), /pkg/beacon_mac.bin (macOS); Linux stage is a UPX-packed ELF pulling Sliver from oob-worker[.]cf99-9b3.workers[.]dev.
• Persistence to hunt: Windows Registry Run key and a scheduled task; macOS LaunchAgent.
• DNS-side detection: TXT lookups to c.*.wel1[.]ru followed by bursts of numbered TXT queries is the distinctive signal, since the HTTPS path may be blocked but the fallback still resolves.

Do not assume takedown of one publisher helps: accounts are randomly named and each publishes only a handful of packages, so npm must review and remove each independently.

Caveats

Chrome-extension and other Unit 42 findings in the summary are separate campaigns, not part of WEL1DROPPER. Package count is a moving figure (nearly 800 → 1,033); Gile notes velocity has slowed since the prior week.