Nearly 800 Malicious npm Packages Found

A new wave of software supply chain attacks has emerged, involving nearly 800 malicious packages recently published to the npm registry. These packages are designed to deploy a cross-platform remote access trojan (RAT) and an infostealer across Windows, macOS, and Linux environments.

Unlike conventional supply chain attacks that exploit lifecycle hooks to trigger execution, this campaign relies on social engineering. The packages include a README file that instructs developers to manually load them using the require() function, a standard method for importing modules and local files.

Tactics of the WEL1DROPPER

Once a developer imports the package, the execution process is initiated by a downloader identified as WEL1DROPPER. This downloader performs reconnaissance on the host, identifying the specific operating system and processor architecture. It then attempts to fetch a compatible payload from one of three Cloudflare Workers hosts.

If the primary HTTPS download fails, the malware pivots to a secondary delivery mechanism using DNS TXT records from the domain wel1.ru. The payload delivery is highly specific to the environment:

• Linux x64: sdk.dl.wel1.ru
• Linux ARM64: ext.dl.wel1.ru
• macOS: pkg.dl.wel1.ru
• Windows: net.dl.wel1.ru

Payload Assembly and Execution

The malware retrieves its payload in chunks by parsing TXT records. Each record contains a portion of the code, which is then reassembled and decoded into a binary buffer. The final stage of the infection is executed using standard system commands: /bin/sh for Linux and macOS, or cmd.exe for Windows.

The package first requests a TXT record from c., It parses the response as the number of payload chunks, accepting a value between 1 and 2,000. It then requests numbered TXT records. The returned strings are joined together and Base64-decoded into a binary buffer.

— Paul McCarty, OpenSourceMalware researcher

Evasive Maneuvers and Persistence

The campaign exhibits sophisticated evasion techniques. On Windows, the malware attempts to patch Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) to bypass security monitoring. It also checks for sandbox environments and establishes persistence via registry keys and scheduled tasks.

The macOS variant mirrors these defensive checks, looking for debuggers or analysis artifacts before deploying its payload. Linux samples are distributed as UPX-packed ELF binaries that eventually deploy Sliver, an open-source command-and-control framework.

Camouflage via Telemetry

To avoid detection during manual code review, the packages include a file named lib/telemetry.js. This file implements a fake telemetry SDK designed to mimic legitimate profiling or analytics functionality. Although the package entry point does not actually import this file, its inclusion is intended to create noise and provide a facade of legitimacy.

Broader Supply Chain Risks

This incident is suspected to be an evolution of a previous dependency confusion campaign known as Moika, which appeared in April and utilized over 250 packages. Recent reports from Unit 42 also highlight separate campaigns targeting both npm and the Python Package Index (PyPI) with cryptocurrency stealers and credential exfiltration tools.

Implications for Security

The reliance on manual developer action to load malicious modules underscores the importance of rigorous vetting for third-party dependencies. For organizations, the presence of these packages suggests that even code that does not execute automatically can pose a significant threat if documentation is followed blindly. Developers are encouraged to verify the authenticity of npm packages and limit the use of untrusted libraries, particularly those that request unusual permissions or offer functionality that mirrors legitimate tools.