A recent discovery has unveiled a significant software supply chain attack involving nearly 800 malicious packages published to the npm registry. These packages are designed to deploy cross-platform malware targeting Windows, macOS, and Linux systems.
Unlike typical npm attacks that exploit lifecycle hooks such as preinstall or postinstall to execute malicious code, this campaign employs a different tactic. The malicious packages include README files instructing developers to load them using the require() function, a standard method for importing modules in Node.js. This approach leads to the execution of a downloader known as WEL1DROPPER.
Upon execution, WEL1DROPPER identifies the host’s operating system and processor architecture. It then fetches a compatible payload from one of three Cloudflare Workers hosts:
- oob-worker.cf103-070.workers[.]dev
- oob-worker.cf102-baf.workers[.]dev
- oob-worker.cf99-9b3.workers[.]dev
If these HTTPS-based downloads fail, the malware resorts to a platform-specific domain, utilizing DNS TXT records to obtain the next-stage payload from “wel1[.]ru.” The payload domains are as follows:
- Linux x64: sdk.dl.wel1[.]ru
- Linux ARM64: ext.dl.wel1[.]ru
- macOS: pkg.dl.wel1[.]ru
- Windows: net.dl.wel1[.]ru
The malware first requests a TXT record from “c.
Further analysis by Sonatype, tracking the campaign under the moniker Flooding Dropper, reveals that the final stage is launched as a detached process. The Windows variant takes steps to patch Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) to evade monitoring, checks for sandboxes and virtual environments, establishes persistence through a Registry Run key and a scheduled task, and downloads an encrypted payload (“/pkg/update_win.exe”) for execution.
The macOS infection chain mirrors this process, performing similar checks for debuggers and analysis artifacts before retrieving a compatible payload (“/pkg/beacon_mac.bin”). If this fails, it employs the DNS TXT delivery method, sets up persistence using a LaunchAgent, and starts the executable in a detached process.
The Linux sample is an UPX-packed ELF binary configured to download auxiliary payloads from a Cloudflare Worker URL (“oob-worker[.]cf99-9b3.workers[.]dev”), ultimately leading to the deployment of Sliver, an open-source command-and-control (C2) framework.
Additionally, the malicious packages contain a file named “lib/telemetry.js” that implements a plausible-looking telemetry SDK but also includes the same downloader logic. The package entry point does not import this file, and it contains no additional hard-coded infrastructure. This oversized telemetry implementation appears intended to add noise and make the malicious behavior look like native profiling or analytics functionality during a quick review.
The presence of domains like “tcsbank[.]ru” and “cloudpayments[.]ru” in the macOS payload suggests a potential focus on Russian financial institutions, indicating a possible financial motivation behind the attack.
This incident underscores the evolving sophistication of supply chain attacks targeting open-source ecosystems. Developers are urged to exercise caution when incorporating new packages, especially those with unclear origins or lacking a substantial download history. Regular audits of project dependencies and the implementation of security tools to detect anomalous behavior are essential steps in mitigating such threats.
