🕵️ WEL1DROPPER

The items that name it 6

• The OpenSourceMalware Show #17
  talk2026-08-14
• The OpenSourceMalware Show #16
  talk2026-08-08

  AI slopsquatting campaign that published over 1,000 malicious npm packages in 72 hours as of the episode; does not use install scripts, executes on import; loosely attributed to Russian threat actors via .ru domain backup stage-two retrieval from TXT records, though attribution is complicated since

• Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages
  writeup2026-08-06

  Threat actor/campaign that published 700+ (later tracked as 788) malicious npm packages over 48 hours delivering a cross-platform RAT/infostealer downloader; suspected Russian origin based on use of .ru domains and embedded Russian financial institution domains (tcsbank.ru, cloudpayments.ru).

• OpenSourceMalware Blog
  article2026-07-18

  AI slopsquatting campaign.

• Open Source Malware Podcast — episodes
  other2026-05-22

  AI slopsquatting campaign

• Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
  article

  Downloader delivered via ~800-1,033 malicious npm packages; identifies host OS/architecture and fetches a compatible RAT/infostealer payload