Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
This digest was compiled by AI from multiple sources — links to the originals are below.
A campaign of nearly 800 malicious npm packages has been identified delivering a cross-platform remote access trojan and infostealer, researcher Paul McCarty of OpenSourceMalware said. The packages use AI-generated typo-squatted names and instruct developers to load them with require() to trigger a multi-stage infection. The malware targets Windows, macOS, and Linux systems through a downloader dubbed WEL1DROPPER.
Infection Mechanism
The malicious npm packages rely on a README instruction directing developers to call require() on the package, sidestepping typical lifecycle hooks. This triggers the downloader WEL1DROPPER, which identifies the host’s operating system and processor architecture. It then fetches a compatible payload from one of three Cloudflare Workers domains: oob-worker.cf103-070.workers[.]dev, oob-worker.cf102-baf.workers[.]dev, or oob-worker.cf99-9b3.workers[.]dev.
Multi-Stage Payload Delivery
If HTTPS downloads fail, the malware switches to DNS TXT record delivery, querying c.<wel1.ru> for payload chunk counts and assembling them. Platform‑specific domains are used: sdk.dl.wel1[.]ru (Linux x64), ext.dl.wel1[.]ru (Linux ARM64), pkg.dl.wel1[.]ru (macOS), and net.dl.wel1[.]ru (Windows). On Windows, the final stage disables ETW and AMSI, checks for sandboxes, establishes persistence via a Registry Run key and scheduled task, and runs an encrypted payload. macOS and Linux variants perform similar sandbox checks and use LaunchAgent or /bin/sh execution.
What's Next
The npm registry has yet to comment on the removal of these packages, and the total number of affected developers is unknown. OpenSourceMalware researchers caution that the use of AI-generated package names points to an automated, scalable effort that may continue in new forms.
1 source
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
