Ethical Hacking News
A recent attack on the npm registry has exposed nearly 800 malicious packages that deliver cross-platform malware targeting Windows, Mac, and Linux systems. The attack appears to be a masterclass in social engineering and supply chain attacks, with the malicious packages using AI-slopped typo squats or randomly generated package names that appear legitimate. To stay ahead of this evolving threat landscape, it's essential for developers and organizations to prioritize software security and take proactive steps to protect themselves against such sophisticated attacks.
Nearly 800 malicious packages were published to the npm registry as part of a new campaign. The attack uses AI-slopped typo squats or randomly generated package names to deliver cross-platform malware targeting Windows, Mac, and Linux systems. The malicious packages execute a downloader named WEL1DROPPER, which identifies the host operating system and processor architecture and fetches a compatible payload from Cloudflare Workers hosts. The final stage of the attack involves writing the payload to a temporary folder and executing it using various methods depending on the operating system. The attack is suspected to be targeting Russian financial institutions and mobile payments, according to the presence of domains like "tcsbank[.]ru" in the macOS payload. Multiple campaigns targeting npm and PyPI repository have been documented by Palo Alto Networks Unit 42, with malicious packages capable of cloud credential exfiltration and delivering various types of malware.
The world of software development has been rocked by a sophisticated and far-reaching attack on the popular npm (Node Package Manager) registry, one of the largest repositories of open-source software. According to recent reports, nearly 800 malicious packages have been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems.
The attack appears to be a masterclass in social engineering and supply chain attacks, with the malicious packages using AI-slopped typo squats or randomly generated package names that appear legitimate. However, all of these packages deliver a powerful Remote Access Trojan (RAT) and infostealer payload. Unlike other npm-oriented software supply chain attacks that make use of lifecycle hooks like preinstall or postinstall to trigger the execution of malicious code, the newly identified packages come with a README file instructing developers to load them with require(), a built-in function to import modules, local files, and third-party packages.
The attack begins when an unsuspecting developer installs one of these malicious packages. The package executes a downloader named WEL1DROPPER, which identifies the host operating system and processor architecture and fetches a compatible payload from one of three Cloudflare Workers hosts. These domains are listed below: oob-worker.cf103-070.workers[.]dev, oob-worker.cf102-baf.workers[.]dev, and oob-worker.cf99-9b3.workers[.]dev.
If the HTTPS-based downloads fail, the malware switches to a platform-specific domain using DNS TXT records to obtain the next-stage from the domain "wel1[.]ru." The payload domain for each operating system and CPU architecture is as follows: Linux x64 - sdk.dl.wel1[.]ru, Linux ARM64 - ext.dl.wel1[.]ru, macOS - pkg.dl.wel1[.]ru, Windows - net.dl.wel1[.]ru.
In the final stage of the attack, the payload is written to a temporary folder and executed either using "/bin/sh" on Linux and macOS, or "cmd.exe" on Windows. Sonatype, which is tracking this campaign under the moniker Flooding Dropper, said that the final stage is launched as a detached process, with the Windows version taking steps to patch Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) to interfere with monitoring, check for sandboxes and virtual environments, establish persistence through a Registry Run key and a scheduled task, and download an encrypted payload ("/pkg/update_win.exe") and run it.
The macOS infection chain is similar, performing an identical set of actions to look for debuggers and analysis artifacts before retrieving a compatible payload ("/pkg/beacon_mac.bin") from a remote server. If this fails, it employs the aforementioned DNS TXT delivery, sets up persistence using a LaunchAgent, and then starts the executable in a detached process.
The Linux sample, on the other hand, is an UPX-packed ELF binary that's configured to download auxiliary payloads from a Cloudflare Worker URL ("oob-worker[.]cf99-9b3.workers[.]dev"), ultimately leading to the deployment of Sliver, an open-source command-and-control (C2) framework. The packages have also been found to contain a file called "lib/telemetry.js" that implements a plausible-looking telemetry SDK but also contains the same downloader logic.
The presence of domains like "tcsbank[.]ru" and "cloudpayments[.]ru" in the macOS payload indicates that the campaign could be targeting Russian financial institutions and mobile payments. It's also suspected to be an evolution of a dependency confusion campaign codenamed Moika, which was observed earlier this April and saw over 250 packages published to the npm registry to steal environment information and deliver an operating system-specific second-stage payload.
This development comes as Palo Alto Networks Unit 42 documented multiple campaigns targeting npm and the Python Package Index (PyPI) repository. A set of 10 npm packages that download an obfuscated cryptocurrency stealer and a remote access trojan from an external server were also identified by Unit 42, with these packages exporting a "getPlugin" function that constructs the URL from which the payload is downloaded as an obfuscated IIFE (Immediately Invoked Function Expression) JavaScript code embedded in a JSON object. The payload implements a crypto stealer and Remote-Access Trojan that allows the attacker to execute arbitrary commands on the infected host.
Malicious packages across npm and PyPI representing multiple distinct threat actors have also been observed, capable of cloud credential exfiltration, delivering EtherHiding blockchain-based C2 droppers, Solana cryptocurrency wallet key theft via Telegram, .env file secret exfiltration, fake-CAPTCHA social engineering remote code execution, and Discord token theft and GitHub Actions CI/CD credential exfiltration.
Threat actors have also been observed using Google Chrome extensions marketed as game emulators, password managers, productivity tools, CSS inspectors, and markdown converters to turn the web browser into a web crawling proxy. These extensions embed an identical commercial web bandwidth-sharing SDK that connects the user's browser to a 3rd party residential proxy network for web scraping operations.
These extensions were found to crawls pages by injecting a hidden iframe into active browser tabs, converts page content to Markdown in the background, and sends it to a remote cloud backend. While some of these extensions disclose the practice in their Chrome Web Store descriptions and in the privacy policies on their SaaS websites, once installed, the third-party SDK prompts users to opt-in to the service.
While the proxy and crawling features remain inactive if the user declines, some extensions frame this opt-in as necessary for uninterrupted service. A notable example is InstaSkip (mdondgockboebafloibbhjofmoedmnnn), which embeds this SDK.
Overall, this attack highlights the need for improved security measures in the software supply chain, particularly with regards to open-source packages and their potential vulnerabilities. As the threat landscape continues to evolve, it's essential for developers and organizations to stay vigilant and take proactive steps to protect themselves against such sophisticated attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Nearly-800-Malicious-npm-Packages-Deliver-Cross-Platform-RAT-and-Infostealer-in-Sophisticated-Software-Supply-Chain-Attack-ehn.shtml
https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html
Published: Fri Aug 7 15:06:04 2026 by llama3.2 3B Q4_K_M
