# Critical npm Supply Chain Attack Delivers Cross-Platform RAT/Infostealer

> Critical npm supply chain attack involving nearly 800 malicious packages delivers WEL1DROPPER RAT and infostealer to Windows, macOS, and Linux users.

- Published: 2026-08-08T00:54:29.000Z
- Severity: high
- Category: Supply Chain
- Tags: NPM, Supply Chain Attack, Infostealer, RAT, WEL1DROPPER
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html
- Canonical: https://runtimerebel.com/blog/critical-npm-supply-chain-attack-delivers-cross-platform-rat-infostealer

## Key points

- Nearly 800 malicious npm packages deliver cross-platform RAT and infostealers, compromising Windows, macOS, and Linux systems.
- Affected systems include any environment installing dependencies from the compromised npm registry.
- Developers must rigorously vet new package dependencies and monitor for suspicious execution patterns.

A widespread and critical [supply chain attack](/glossary#supply-chain-attack) has been identified, involving nearly 800 malicious packages published to the npm registry. This sophisticated campaign delivers a cross-platform [Remote Access Trojan (RAT)](/glossary#remote-access-trojan-rat) and [infostealer](/glossary#infostealer), actively targeting Windows, macOS, and Linux operating systems. Researchers at OpenSourceMalware first reported this activity, with Sonatype tracking the campaign under the moniker "Flooding Dropper." The incident highlights a significant threat to the software supply chain, impacting developers and organizations relying on the npm ecosystem, as detailed by The Hacker News.

The threat actors behind this campaign utilize randomly generated or typo-squatted package names to distribute their malicious payloads. Unlike common npm supply chain attacks that [exploit](/glossary#exploit) `preinstall` or `postinstall` lifecycle hooks, these packages employ a deceptive `README` file. This `README` instructs developers to explicitly load the package using the `require()` function, which is a built-in Node.js function for importing modules. This method allows the malicious code to execute as part of the application's runtime, circumventing typical security measures designed to detect automated execution during installation.

## Technical Analysis of the npm Supply Chain Attack

The infection chain initiated by these malicious npm packages leads to the execution of a downloader named WEL1DROPPER. Upon execution, WEL1DROPPER first identifies the host operating system and processor architecture. This [reconnaissance](/glossary#reconnaissance) phase enables it to fetch a compatible second-stage [payload](/glossary#payload) from one of three Cloudflare Workers hosts. This multi-platform capability ensures a broad [attack surface](/glossary#attack-surface) across different development environments.

### Multi-Stage Payload Delivery and Evasion Tactics

Should the initial HTTPS-based downloads from Cloudflare Workers fail, the [malware](/glossary#malware) employs a sophisticated fallback mechanism. It switches to a platform-specific domain, `wel1[.]ru`, and leverages DNS TXT records to obtain subsequent payload stages. According to OpenSourceMalware, the process involves requesting a TXT record to determine the number of payload chunks (between 1 and 2,000), then requesting numbered TXT records, joining the returned strings, and Base64-decoding them into a binary buffer. This technique makes the payload retrieval stealthier and more resilient against network filtering.

The final stage involves writing the decoded payload to a temporary folder and executing it. On Linux and macOS systems, this is achieved using `/bin/sh`, while Windows systems use `cmd.exe`. The malware then launches the payload as a detached process, further complicating detection and termination.

*   **Windows-Specific Behaviors**: The Windows version of the payload incorporates advanced evasion techniques. It attempts to [patch](/glossary#patch) Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) to interfere with monitoring and analysis tools. It also checks for the presence of sandboxes and virtual environments. For [persistence](/glossary#persistence), it establishes a Registry Run key and creates a scheduled task. This variant downloads an encrypted payload, `/pkg/update_win.exe`, and executes it.
*   **macOS-Specific Behaviors**: The macOS infection chain mirrors the Windows version in its sophisticated approach. It performs similar checks for debuggers and and analysis artifacts before retrieving a compatible payload, `/pkg/beacon_mac.bin`, from a remote server. If this primary method fails, it also resorts to the aforementioned DNS TXT delivery. Persistence is achieved through a LaunchAgent, and the executable is subsequently started as a detached process.
*   **Linux-Specific Behaviors**: The Linux sample is distributed as an UPX-packed ELF binary. It is configured to download auxiliary payloads from another Cloudflare Worker URL, `oob-worker[.]cf99-9b3.workers[.]dev`. This ultimately leads to the deployment of Sliver, an open-source command-and-control ([C2](/glossary#c2)) framework, giving attackers extensive control over compromised systems.

The malicious packages also include a file named `lib/telemetry.js`. This file implements what appears to be a plausible telemetry SDK but contains the same downloader logic. This "oversized telemetry implementation" is intended to add noise and make the malicious behavior blend in with legitimate profiling or analytics functionality, hindering quick reviews and detection.

Initial analysis, based on domains like `tcsbank[.]ru` and `cloudpayments[.]ru` found in the macOS payload, suggests the campaign could be targeting Russian financial institutions and mobile payments. This campaign is also suspected to be an evolution of a previously identified [dependency confusion](/glossary#dependency-confusion) campaign, codenamed Moika, which appeared in April and involved over 250 npm packages. Palo Alto Networks Unit 42 has also documented multiple campaigns targeting the npm and PyPI repositories, underscoring the escalating threat of software supply chain attacks.

## Mitigating npm Supply Chain Attack Risks

Defending against sophisticated attacks like the Flooding Dropper requires a multi-layered approach to Software Supply Chain Security. Organizations and developers must prioritize proactive measures to identify and neutralize threats before they can impact production environments.

### Key Recommendations for Detecting WEL1DROPPER Malware and Preventing Future Attacks:

*   **Strict Dependency Vetting**: Implement rigorous processes for vetting all third-party npm package dependencies, especially new ones. Scrutinize the package's origin, author reputation, and historical activity before integration.
*   **Code Review and Static Analysis**: Conduct thorough code reviews and utilize static application security testing (SAST) tools. Look for suspicious `require()` calls or unusual `lib/telemetry.js` implementations that might hide malicious downloader logic.
*   **Network Monitoring**: Monitor outbound network connections from build systems and runtime environments. Look for connections to suspicious domains, including Cloudflare Workers hosts used by WEL1DROPPER, `wel1[.]ru`, and `oob-worker[.]cf99-9b3.workers[.]dev`. DNS query monitoring for unusual TXT record requests is also crucial.
*   **[Endpoint](/glossary#endpoint) Detection and Response ([EDR](/glossary#edr))**: Deploy EDR solutions capable of detecting `WEL1DROPPER` activity, such as attempts to patch ETW or AMSI, creation of suspicious Registry Run keys, scheduled tasks, or LaunchAgents for persistence. Monitor for unusual process execution, especially those involving `/bin/sh` or `cmd.exe` launching unexpected binaries from temporary directories.
*   **Developer Education**: Educate developers on the risks associated with blindly following `README` instructions, particularly those involving `require()` calls for new or unknown packages. Emphasize the importance of understanding the code being imported.
*   **Dependency Management Tools**: Leverage automated dependency analysis tools that can flag outdated, vulnerable, or potentially malicious packages within your projects. This helps in managing npm supply chain attack mitigation effectively.

By adopting these preventative and detection strategies, organizations can significantly reduce their exposure to similar npm supply chain threats and safeguard their development ecosystems.

**Related:** [Shai-Hulud Infostealer Surfaces in Malicious npm Package Campaign](/blog/shai-hulud-infostealer-surfaces-in-malicious-npm-package-campaign), [Jscrambler npm Package Backdoored with Infostealer Malware](/blog/jscrambler-npm-package-backdoored-with-infostealer-malware)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/critical-npm-supply-chain-attack-delivers-cross-platform-rat-infostealer