Skip to content

Back to the catalog

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages
opensourcemalware.comwriteup

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

OpenSourceMalware documents WEL1DROPPER (aka Flooding Dropper), a campaign that published 788+ slopsquatted npm packages (e.g. checkout-mobile-bnpl) which execute on require() with no install script, downloading cross-platform RAT/infostealer payloads via rotating Cloudflare Workers URLs with a DNS TXT-record fallback channel. The writeup reverse-engineers the Linux (UPX-packed ELF) and macOS (universal Mach-O) second-stage payloads, detailing anti-analysis checks, LaunchAgent persistence disguised as com.apple.windowserver.helper, XOR-obfuscated C2 domains, a suspected Sliver C2 final stage, and ties the campaign to Russian financial-sector lures and the earlier Moika npm campaign.

TL;DR 788+ slopsquatted npm packages execute on import (no install script) to drop cross-platform RATs via Cloudflare Workers/DNS-TXT fallback, with macOS payload adding anti-analysis, LaunchAgent persistence, and a suspected Sliver C2 stage.
Open original ↗
Document

What it is

A campaign (WEL1DROPPER / Flooding Dropper / NUL1DROPPER) of 700+ malicious npm packages published over ~48 hours, exemplified by checkout-mobile-bnpl@35.6.9, which poses as a mobile/BNPL SDK. Its init()/version()/configure() API does nothing real; the payload is triggered purely by importing the package.

How it works

index.js ends with try { require("./_helpers"); } catch (_) {}. _helpers.js calls its own run() on load, so no lifecycle script and no SDK method call is needed — require() alone starts the chain. It fingerprints OS/arch, then attempts an HTTPS GET (forced IPv4, 15s timeout, User-Agent: node-fetch/2.6) against three rotated hosts, accepting a response only on HTTP 200 with >1,000 bytes. There is no signature, hash, or cert-pinning check. On failure it falls back to DNS TXT reconstruction: query c.<domain> for a chunk count (1–2,000), fetch 0..n-1.<domain>, join and Base64-decode.

Preconditions / Affected

npm ecosystem, cross-platform (Windows x64/x86, macOS x64/ARM64, Linux x64/ARM64). Install-script blocking does NOT protect you — the trigger is import during dev, test, or production startup. macOS payload additionally establishes persistence and retrieves a second beacon.

What to do

Hunt for these concrete IOCs. C2 hosts:

oob-worker.cf103-070.workers.dev
oob-worker.cf102-baf.workers.dev
oob-worker.cf99-9b3.workers.dev

DNS fallback domains (TXT lookups to predictable names like c.<domain>, 0.<domain>):

sdk.dl.wel1.ru   (Linux x64)
ext.dl.wel1.ru   (Linux ARM64)
pkg.dl.wel1.ru   (macOS)
net.dl.wel1.ru   (Windows)

On-disk artifacts — dropped payload, launched detached:

/var/tmp/.cache_<8 hex>     -> /bin/sh -c "... &"   (Linux/macOS)
%TEMP%\dotnet_diag_<8 hex>.exe -> cmd.exe /c start /b  (Windows)

Rate-limit marker (re-run suppressed ~6h / 21,760s), NOT actual analytics:

/tmp/.analytics_state
%TEMP%\analytics_state
flowchart TD
  A[require package] --> B[_helpers run]
  B --> C{HTTPS GET
3 workers.dev hosts}
  C -->|200 and >1000 bytes| E[write & exec payload]
  C -->|all fail| D[DNS TXT
c.wel1.ru chunks]
  D --> E
  E --> F[.analytics_state
6h marker]

Caveats

Payloads across sampled packages are "exactly the same" apart from minor workers.dev C2 differences, so these IOCs should generalize across the 700+ packages — but only multiple packages were analyzed, not all. DNS-tunneling detections keyed on known tooling will likely miss this, since traffic is ordinary TXT lookups to a small predictable name set.

Technologies named here

Techniques named here

Threat actors named here

Related in Supply Chain