npm Under Siege: Hundreds of Malicious Packages Unleash Cross-Platform RATs and Infostealers

The digital supply chain is under renewed assault, with a staggering cluster of nearly 800 malicious packages recently discovered on the npm registry. This sophisticated campaign is designed to deploy potent cross-platform malware, threatening developers and systems running Windows, macOS, and Linux alike.

A Stealthy Infiltration: The WEL1DROPPER Campaign

Unlike many previous npm-oriented software supply chain attacks that leverage automated lifecycle hooks (like preinstall or postinstall) to trigger malicious code, this new threat employs a more subtle approach. OpenSourceMalware researcher Paul McCarty highlights that these packages, often using “AI slop squatted” or randomly generated typo-squatting names, all deliver a powerful Remote Access Trojan (RAT) and infostealer payload.

The attack vector is deceptively simple: developers are instructed via the package’s README file to load the module using require(), a standard Node.js function for importing modules. This seemingly innocuous action initiates the execution of a downloader dubbed “WEL1DROPPER.”

Multi-Stage Payload Delivery

Upon execution, WEL1DROPPER intelligently identifies the host operating system and processor architecture. It then proceeds to fetch a compatible, next-stage payload from one of three Cloudflare Workers hosts:

• oob-worker.cf103-070.workers[.]dev
• oob-worker.cf102-baf.workers[.]dev
• oob-worker.cf99-9b3.workers[.]dev

Should these HTTPS-based downloads falter, the malware demonstrates remarkable resilience by switching to a platform-specific domain, utilizing DNS TXT records to retrieve its next stage from wel1[.]ru. McCarty elaborated on this ingenious fallback: “The package first requests a TXT record from c. It parses the response as the number of payload chunks, accepting a value between 1 and 2,000. It then requests numbered TXT records. The returned strings are joined together and Base64-decoded into a binary buffer.”

Platform-Specific Malicious Capabilities

The final payload, once assembled, is written to a temporary folder and executed using either /bin/sh on Linux and macOS, or cmd.exe on Windows. Each operating system variant exhibits tailored malicious behaviors:

Windows Systems: Evasion and Persistence

Sonatype, tracking this campaign as “Flooding Dropper,” notes that the Windows payload launches as a detached process. It actively works to evade detection by patching Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI). Furthermore, it checks for sandboxes and virtual environments, establishes persistence via a Registry Run key and a scheduled task, and ultimately downloads and runs an encrypted payload (/pkg/update_win.exe).

macOS Systems: Debugger Evasion and LaunchAgent Persistence

The macOS infection chain mirrors the Windows variant in its initial stages, performing checks for debuggers and analysis artifacts. It attempts to retrieve a compatible payload (/pkg/beacon_mac.bin) from a remote server. If this fails, it falls back to the DNS TXT delivery method, establishes persistence using a LaunchAgent, and then executes the payload as a detached process.

Linux Systems: Sliver C2 Deployment

The Linux sample, an UPX-packed ELF binary, is designed to download auxiliary payloads from a Cloudflare Worker URL (oob-worker[.]cf99-9b3.workers[.]dev). This ultimately leads to the deployment of Sliver, a powerful open-source command-and-control (C2) framework, giving attackers extensive control over compromised Linux machines.

Deception and Potential Targets

Adding to the sophistication, these malicious packages often include a file named lib/telemetry.js

. While appearing to be a legitimate telemetry SDK, it cleverly contains the same downloader logic. OpenSourceMalware suggests this “oversized telemetry implementation appears intended to add noise and make the malicious behavior look like native profiling or analytics functionality during a quick review,” making it harder for developers to spot the true intent.

Intriguingly, the presence of domains like tcsbank[.]ru and cloudpayments[.]ru within the macOS payload suggests a potential focus on Russian financial institutions and mobile payment systems. This campaign is also suspected to be an evolution of “Moika,” a dependency confusion campaign from April that saw over 250 npm packages deployed to steal environment information.

The Broader Software Supply Chain Threat

This npm assault is not an isolated incident. Palo Alto Networks Unit 42 has simultaneously documented multiple campaigns targeting both npm and the Python Package Index (PyPI) repository:

• A set of 10 npm packages delivering an obfuscated cryptocurrency stealer and a remote access trojan. These packages export a

  getPlugin function that constructs a URL to download an obfuscated JavaScript payload, enabling arbitrary command execution and crypto theft.

• Various malicious packages across npm and PyPI, attributed to distinct threat actors, capable of cloud credential exfiltration, deploying EtherHiding blockchain-based C2 droppers, stealing Solana cryptocurrency wallet keys via Telegram, exfiltrating .env file secrets, and engaging in fake-CAPTCHA social engineering.

The relentless barrage of these supply chain attacks underscores the critical need for vigilance and robust security practices within the software development ecosystem. Developers must exercise extreme caution when integrating third-party packages, and organizations should implement comprehensive security measures to detect and mitigate such advanced threats.

For more details, visit our website.

Source: Link