{"id":2280,"date":"2026-08-07T20:16:32","date_gmt":"2026-08-07T20:16:32","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2280"},"modified":"2026-08-07T20:16:32","modified_gmt":"2026-08-07T20:16:32","slug":"nearly-800-malicious-npm-packages-deliver-cross-platform-rat-and-infostealer","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2280","title":{"rendered":"Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiIEXaa59LRblZ0rcBVbKDdH4w9Rszk27anNt20Onx7Li8D7FXbf3Ipod53uo3N2aa6Hj1QLJaNFDIBlrcgM3YZg0UJCsjI3maDKkFEdOeyhzis15St3QDg6WCXcYlbDRlw2WvgiOH-BL_v8I21QoSTE9kmJzzKqQwstqn11JWkAL1_9W41ZF04T-9ImaiL\/s1700-e365\/npms.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems.<\/p>\n<p>\u00abThese packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload,\u00bb OpenSourceMalware researcher Paul McCarty <a href=\"https:\/\/opensourcemalware.com\/blog\/russian-ai-slopsquatting-npm-campaign\" target=\"_blank\">said<\/a>.<\/p>\n<p>Unlike other npm-oriented software supply chain attacks that make use of lifecycle hooks like preinstall or postinstall to trigger the execution of malicious code, the newly identified packages come with a README that instructs developers to load them with require(), a built-in function to import modules, local files, and third-party packages.<\/p>\n<p>The attack leads to the execution of a downloader named <strong><a href=\"https:\/\/opensourcemalware.com\/?search=%23wel1dropper\" target=\"_blank\">WEL1DROPPER<\/a><\/strong>, which, when executed, identifies the host operating system and processor architecture and fetches a compatible payload from one of the three Cloudflare Workers hosts. The three Cloudflare Workers domains are listed below &#8211;<\/p>\n<ul>\n<li>oob-worker.cf103-070.workers[.]dev<\/li>\n<li>oob-worker.cf102-baf.workers[.]dev<\/li>\n<li>oob-worker.cf99-9b3.workers[.]dev<\/li>\n<\/ul>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/threatlocker-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh5OTk93vfDmhLLtqoMsx4w59kseqsUysQ92SKB-S2vDoKsMmMfCCkx8AbG5MFzFvZ7rkzKd5LtgOCxlRF2FJ-0FArsVhpOnTMX31VBi9TX-z1Pgv9oSvXiT23KyDlxtVqI0dPRdMIuWc9fbNWgQF8CisKtMme0LpNr79b4wRaeDRxCjfGB8GsxfXa8Ltro\/s728-e100\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>If the HTTPS-based downloads fail, the malware switches to a platform-specific domain and uses DNS TXT records to obtain the next-stage from the domain \u00abwel1[.]ru.\u00bb The payload domain for each operating system and CPU architecture is as follows &#8211;<\/p>\n<ul>\n<li>Linux x64 &#8211; sdk.dl.wel1[.]ru<\/li>\n<li>Linux ARM64 &#8211; ext.dl.wel1[.]ru<\/li>\n<li>macOS &#8211; pkg.dl.wel1[.]ru<\/li>\n<li>Windows &#8211; net.dl.wel1[.]ru<\/li>\n<\/ul>\n<p>\u00abThe package first requests a TXT record from c.<domain>,\u00bb McCarty explained. \u00abIt parses the response as the number of payload chunks, accepting a value between 1 and 2,000. It then requests numbered TXT records. The returned strings are joined together and Base64-decoded into a binary buffer.\u00bb<\/domain><\/p>\n<p><a name=\"more\"\/><\/p>\n<p>In the final stage, the payload is written to a temporary folder and executed either using \u00ab\/bin\/sh\u00bb on Linux and macOS, or \u00abcmd.exe\u00bb on Windows.<\/p>\n<p>Sonatype, which is also <a href=\"https:\/\/www.sonatype.com\/blog\/flooding-dropper-hits-npm-with-850-malicious-packages\" target=\"_blank\">tracking<\/a> the campaign under the moniker Flooding Dropper, said the final stage is launched as a detached process, with the Windows version taking steps to patch Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) to interfere with monitoring, check for sandboxes and virtual environments, establish persistence through a Registry Run key and a scheduled task, and download an encrypted payload (\u00ab\/pkg\/update_win.exe\u00bb) and run it.<\/p>\n<p>The macOS infection chain is similar, performing an identical set of actions to look for debuggers and analysis artifacts before retrieving a compatible payload (\u00ab\/pkg\/beacon_mac.bin\u00bb) from a remote server. If this fails, it employs the aforementioned DNS TXT delivery, sets up persistence using a LaunchAgent, and then starts the executable in a detached process.<\/p>\n<p>The Linux sample, on the other hand, is an <a href=\"https:\/\/www.iblue.team\/malware-analysis\/identifying-upx-packed-elf-decompressing-fixing-and-analysing-linux-malware\" target=\"_blank\">UPX-packed<\/a> ELF binary that&#8217;s configured to download auxiliary payloads from a Cloudflare Worker URL (\u00aboob-worker[.]cf99-9b3.workers[.]dev\u00bb), ultimately leading to the deployment of Sliver, an open-source command-and-control (C2) framework.<\/p>\n<p>The packages have also been found to contain a file called \u00ablib\/telemetry.js\u00bb that implements a plausible-looking telemetry SDK but also contains the same downloader logic.<\/p>\n<p>\u00abThe package entry point does not import this file, and it contains no additional hard-coded infrastructure,\u00bb OpenSourceMalware said. \u00abThe oversized telemetry implementation appears intended to add noise and make the malicious behavior look like native profiling or analytics functionality during a quick review.\u00bb<\/p>\n<p>The presence of domains like \u00abtcsbank[.]ru\u00bb and \u00abcloudpayments[.]ru\u00bb in the macOS payload indicates that the campaign could be targeting Russian financial institutions and mobile payments.<\/p>\n<p>It&#8217;s also suspected to be an evolution of a dependency confusion campaign codenamed <a href=\"https:\/\/opensourcemalware.com\/?search=%23moika\" target=\"_blank\">Moika<\/a> that was observed earlier this April and saw over 250 packages published to the npm registry to steal environment information and deliver an operating system-specific second-stage payload.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/corelight-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuvAqH13TTYyJD3aI-pJcYl54BoxQWMHc2aFwW2HbYUa5IKCjvHlzpzkFwXLTuV8aytky8kqLBgkoOtC8VQM5CGR0N5BXBl8RSXl-PYx_vIPbiLywiqXIvTPmm18cdEm_C0heVB-3U8zfG7K27RCAurtJ7OvxEyfQ0sVV_RRx1N4ZMWkqKgEBmkcDgjD6I\/s728-e100\/code-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The development comes as Palo Alto Networks Unit 42 documented multiple campaigns targeting npm and the Python Package Index (PyPI) repository &#8211;<\/p>\n<ul>\n<li>A set of <a href=\"https:\/\/github.com\/PaloAltoNetworks\/Unit42-timely-threat-intel\/blob\/main\/2026-08-06-Obfuscated-JavaScript-Crypto-Stealer.txt\" target=\"_blank\">10 npm packages<\/a> that download an obfuscated cryptocurrency stealer and a remote access trojan from an external server. \u00abAfter installation, the packages export a &#8216;getPlugin&#8217; function that constructs the URL from which the payload is downloaded as an obfuscated IIFE (Immediately Invoked Function Expression) JavaScript code embedded in a JSON object,\u00bb Unit 42 said. \u00abThe payload implements a crypto stealer and Remote-Access Trojan (RAT) that allows the attacker to execute arbitrary commands on the infected host.\u00bb<\/li>\n<li>A set of <a href=\"https:\/\/github.com\/PaloAltoNetworks\/Unit42-timely-threat-intel\/blob\/main\/2026-07-21-Malicious-npm-PyPI-Supply-Chain-packages.txt\" target=\"_blank\">malicious packages across npm and PyPI<\/a> representing multiple distinct threat actors that are capable of cloud credential exfiltration, delivering EtherHiding blockchain-based C2 droppers, Solana cryptocurrency wallet key theft via Telegram, .env file secret exfiltration, fake-CAPTCHA social engineering remote code execution, and Discord token theft and GitHub Actions CI\/CD credential exfiltration.<\/li>\n<\/ul>\n<h3>From Packages to Chrome Extensions<\/h3>\n<p>Threat actors have also been observed using Google Chrome extensions marketed as game emulators, password managers, productivity tools, CSS inspectors, and markdown converters to turn the web browser into a web crawling proxy. The crawl commands are received remotely via a persistent WebSocket connection.<\/p>\n<p>\u00abThese extensions embed an identical commercial web bandwidth-sharing SDK that connects the user&#8217;s browser to a 3rd party residential proxy network for web scraping operations,\u00bb Unit 42 <a href=\"https:\/\/github.com\/PaloAltoNetworks\/Unit42-timely-threat-intel\/blob\/main\/2026-07-29-Browser-as-proxy-extensions.txt\" target=\"_blank\">said<\/a>, adding it crawls pages by injecting a hidden iframe into active browser tabs, converts page content to Markdown in the background, and sends it to a remote cloud backend.<\/p>\n<p>The cybersecurity company noted that some of these extensions disclose the practice in their Chrome Web Store descriptions and in the privacy policies on their SaaS websites. Once installed, the third-party SDK prompts users to opt-in to the service.<\/p>\n<p>\u00abWhile the proxy and crawling features remain inactive if the user declines, some extensions frame this opt-in as necessary for uninterrupted service,'\u00bb Unit 42 said. \u00abA notable example is InstaSkip (mdondgockboebafloibbhjofmoedmnnn), which embeds this SDK.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2281,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[342,529,695,33,39,35,264],"class_list":["post-2280","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-crossplatform","tag-deliver","tag-infostealer","tag-malicious","tag-npm","tag-packages","tag-rat"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2280"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2280\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2281"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}