An extensive software supply chain attack targeting developers and systems running Windows, Mac OS, and Linux has identified approximately 800 malicious packages on the npm registry as part of this campaign. Researchers report that the campaign represents a shift from traditional typosquatting to high-volume "AI slop-squatting."
A malicious attacker may generate an enormous number of plausible-looking package names rather than merely imitating a few popular libraries, which may be selected by mistake through developer typos, automated suggestions, or artificial intelligence coding assistants. The threat actors can cast a much wider net over the NPM ecosystem this way, according to OpenSourceMalware researcher Paul McCarty. The packages appear legitimate by using AI-generated, squatted, randomly generated, or typosquatted names.
Upon installation, they deploy WEL1DROPPER, a downloader designed to identify the operating system and processor architecture of the victim before retrieving the appropriate malware payload.
The README files of the packages instruct developers to load the malicious modules using JavaScript's built-in require() function, as opposed to many npm supply chain attacks that utilize preinstall or postinstall scripts.
A malicious behavior may be less apparent during installation using this approach. Furthermore, the campaign highlights how threat actors are increasingly distributing RAT components across multiple NPM packages as opposed to relying exclusively on a single malicious package. By using this approach, malware can be spread across a broader developer ecosystem, and individual malicious components can be more difficult to detect during routine package reviews.
This campaign targets developers working across Windows, Linux, and macOS environments, increasing the reach of the campaign beyond one operating system.
When the HTTPS delivery fails, it switches to DNS TXT records associated with the domain wel1[.]ru. If the next-stage payload cannot be downloaded from Cloudflare Workers. Upon access to the compromised system, the malware retrieves multiple encoded chunks, combines them, decodes the resulting data, and executes the payload.
Sonatype has identified the campaign as Flooding Dropper. In its analysis, Sonatype found additional capabilities designed to evade security monitoring and maintain persistence. In Windows, the malware is reported to interfere with Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI), check for virtual environments and sandboxes, as well as establish persistence through Registry Run keys and scheduled processes.
A compromised development environment or continuous integration/continuous delivery system can contain valuable credentials and secrets, including cloud access credentials, SSH credentials, NPM tokens, source code, and environment variables. These risks extend beyond the individual developer workstation. Infections of such systems can therefore allow attackers access to resources that go well beyond the machine originally compromised.
As with the MacOS version, the macOS variant searches for analytical and debugging artifacts before establishing persistence with a LaunchAgent. This Linux version has been delivered as an ELF executable packed with UPX and will allow Sliver, an open-source control framework, to be deployed. Among the packages, researchers also found a legitimate file called telemetry.js.
It appears, however, that the file has the same downloader functionality and is intended to create additional noise and make the packages appear to be ordinary analytics or profiling software, thus confusing.
According to researchers, the macOS payload contains references to Russian banking and payment services, suggesting that the campaign has ties to Russian financial targets.
As suspected by OpenSourceMalware, this operation could represent an evolution of the Moika campaign, which previously involved hundreds of malicious npm packages. As opposed to a conventional software vulnerability, the activity is being treated as a malware distribution campaign that has been actively deployed. Packages have been published to the public npm registry and are being removed as they become apparent.
In addition, researchers indicated that the campaign is not related to a CVE or listed as a CISA Known Exploited Vulnerability, highlighting the primary concern as being exposed to malicious dependencies rather than exploiting a flaw in npm itself. Security teams should review dependency manifests and lockfiles for unfamiliar packages, investigate newly introduced dependencies, and monitor npm and Node.js processes to determine if there has been any unusual network activity or access to sensitive credentials.
Furthermore, organizations should implement stronger controls on AI-suggested dependencies and restrict package installation through trusted internal repositories.
As malware can execute prior to developers identifying a malicious package, finding a malicious package should result in an exposure assessment, rather than simply removing it from the system.
Security risks associated with open-source software ecosystems are being increasingly highlighted by the campaign, where malicious dependencies can make trusted development environments a launching pad for broader compromises.
Organizations should strengthen dependency monitoring, verify unfamiliar packages, and carefully inspect software introduced to developer environments and continuous integration and continuous delivery systems.
.jpg "OpenAI and Anthropic AI Agents Crossed Testing Boundaries During Cybersecurity Evaluations")
.jpg)