**NPM Registry Compromised: Nearly 800 Malicious Packages Delivered Cross-Platform Malware**
A significant supply chain attack has been discovered targeting the NPM (Node Package Manager) registry, with nearly 800 malicious packages published in a campaign designed to deliver cross-platform malware. The attack specifically targets Windows, Mac, and Linux systems, according to research by OpenSourceMalware.
The malicious packages utilize “AI slop” or randomly generated typo-squatting names to appear legitimate. However, their primary function is to deliver a powerful Remote Access Trojan (RAT) and infostealer payload. Unlike many previous NPM attacks that rely on lifecycle hooks (such as `preinstall` or `postinstall`) to execute malicious code, this campaign takes a more direct approach. The packages’ README files explicitly instruct developers to load them using the `require()` function, a built-in method for importing modules, local files, and third-party packages.
Once a developer follows these instructions, the attack is triggered. A downloader named **WEL1DROPPER** is executed. This downloader first identifies the host operating system and processor architecture. It then contacts one of three Cloudflare Workers domains to fetch a compatible payload. If this HTTPS-based download fails, the malware has a contingency plan: it switches to a domain-specific mechanism, using DNS TXT records to retrieve the next stage from “wel1.ru”.
The payload domains are tailored to the target operating system and CPU architecture:
* **Linux x64:** sdk.dl.wel1[.]ru
* **Linux ARM64:** ext.dl.wel1[.]ru
* **macOS:** pkg.dl.wel1[.]ru
* **Windows:** net.dl.wel1[.]ru
The final stage of the attack involves writing the payload to a temporary folder and executing it. Detailed analysis by Sonatype, which tracked the campaign under the name “Flooding Dropper,” reveals the sophistication of the malware. The Windows version attempts to patch security mechanisms like Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI). It also establishes persistence through Registry Run keys and scheduled tasks. The macOS variant performs similar checks for debuggers before retrieving its payload. The Linux variant is a UPX-packed ELF binary that ultimately deploys Sliver, a well-known open-source command-and-control (C2) framework.
Adding another layer of deception, the packages contain a file named “lib/telemetry.js.” This file masquerades as a legitimate telemetry Software Development Kit (SDK) but contains the same malicious downloader logic. The oversized file is believed to be intentional “noise,” designed to make the malware look like benign profiling or analytics functionality during a quick review.
The campaign’s targets appear to include Russian financial institutions, as indicated by domains like “tcsbank[.]ru” and “cloudpayments[.]ru” found within the macOS payload. This suggests the operation may be an evolution of a previous dependency confusion campaign codenamed “Moika.”
This discovery is part of a broader wave of attacks on software repositories. Palo Alto Networks Unit 42 has also recently reported on numerous other campaigns targeting NPM and the Python Package Index (PyPI). These include packages designed to steal cryptocurrency, exfiltrate cloud credentials, and steal Discord and GitHub tokens.
In a related trend, threat actors have also begun weaponizing Google Chrome extensions. Marketed as tools for game emulators, password managers, and productivity aids, these extensions can turn a user’s browser into a web crawling proxy. They embed a commercial SDK that connects users to a third-party residential proxy network for scraping operations, with some extensions explicitly asking users to opt-in to this service.
—
### FAQ
**Q: What is the primary danger of these NPM packages?**
A: The packages are malicious and deliver a powerful Remote Access Trojan (RAT) and infostealer. Once installed, they can give attackers complete control over a user’s computer, steal sensitive information, and establish persistence on the system.
**Q: How can developers protect themselves from these packages?**
A: The most critical step is to **never** follow instructions in a package’s README that tell you to use `require()` to load the package directly. Always verify the publisher’s legitimacy, check the package’s popularity and download count, and be extremely cautious of newly published packages with random or typo-squatting names.
**Q: What makes this attack different from other NPM supply chain attacks?**
A: Unlike many attacks that use lifecycle scripts (like `preinstall`) to run code automatically, this attack relies on the developer to manually execute the malicious code by following the README instructions. This makes it a more social engineering-based attack.
**Q: Which operating systems are targeted by this malware?**
A: The malware is designed to be cross-platform and targets Windows, macOS, and Linux systems. It detects the operating system and CPU architecture to download the correct payload.
**Q: What is the “Flooding Dropper” campaign?**
A: “Flooding Dropper” is the name given by the security firm Sonatype to this specific malware campaign. It refers to the massive scale of the attack, involving nearly 800 packages, and the method of using a “downloader” to fetch the final payload.
—
### Conclusion
The discovery of nearly 800 malicious NPM packages delivering a sophisticated, cross-platform RAT highlights the ongoing vulnerability of the software supply chain. This attack is particularly insidious because it combines social engineering, deceptive naming conventions, and a multi-stage payload delivery system. The ability to target multiple operating systems from a single package library significantly increases the potential reach and impact of the malware. As attackers continue to innovate, developers and organizations must remain vigilant, implementing strict security policies for package management and relying on trusted, well-maintained repositories to mitigate the risk of supply chain compromises.
