[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fO02iV0wOTx88OtrXys8fN_m5TC7n2lF8g2N3UeP6Fac":3},{"article":4,"iocs":55},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"4dbb86ca-666d-4c7b-bf79-3c0989d4fc24","Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer","nearly-800-malicious-npm-packages-deliver-cross-platform-rat-and-infostealer-7f2f00","A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. \"These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload,\" OpenSourceMalware researcher Paul","A campaign involving nearly 800 malicious npm packages has been discovered, targeting Windows, Mac, and Linux systems with a cross-platform RAT and infostealer. These packages, using AI-generated or typo-squatted names, instruct developers to load them via require(), leading to the execution of a downloader that fetches compatible payloads from Cloudflare Workers or uses DNS TXT records for delivery. The final payloads aim to evade detection, establish persistence, and deploy tools like Sliver on Linux.","Nearly 800 malicious npm packages deliver cross-platform RAT and infostealer.","Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer Ravie LakshmananAug 07, 2026Malware \u002F Browser Security A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. \"These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload,\" OpenSourceMalware researcher Paul McCarty said. Unlike other npm-oriented software supply chain attacks that make use of lifecycle hooks like preinstall or postinstall to trigger the execution of malicious code, the newly identified packages come with a README that instructs developers to load them with require(), a built-in function to import modules, local files, and third-party packages. The attack leads to the execution of a downloader named WEL1DROPPER, which, when executed, identifies the host operating system and processor architecture and fetches a compatible payload from one of the three Cloudflare Workers hosts. The three Cloudflare Workers domains are listed below - oob-worker.cf103-070.workers[.]dev oob-worker.cf102-baf.workers[.]dev oob-worker.cf99-9b3.workers[.]dev If the HTTPS-based downloads fail, the malware switches to a platform-specific domain and uses DNS TXT records to obtain the next-stage from the domain \"wel1[.]ru.\" The payload domain for each operating system and CPU architecture is as follows - Linux x64 - sdk.dl.wel1[.]ru Linux ARM64 - ext.dl.wel1[.]ru macOS - pkg.dl.wel1[.]ru Windows - net.dl.wel1[.]ru \"The package first requests a TXT record from c.\u003Cdomain>,\" McCarty explained. \"It parses the response as the number of payload chunks, accepting a value between 1 and 2,000. It then requests numbered TXT records. The returned strings are joined together and Base64-decoded into a binary buffer.\" In the final stage, the payload is written to a temporary folder and executed either using \"\u002Fbin\u002Fsh\" on Linux and macOS, or \"cmd.exe\" on Windows. Sonatype, which is also tracking the campaign under the moniker Flooding Dropper, said the final stage is launched as a detached process, with the Windows version taking steps to patch Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) to interfere with monitoring, check for sandboxes and virtual environments, establish persistence through a Registry Run key and a scheduled task, and download an encrypted payload (\"\u002Fpkg\u002Fupdate_win.exe\") and run it. The macOS infection chain is similar, performing an identical set of actions to look for debuggers and analysis artifacts before retrieving a compatible payload (\"\u002Fpkg\u002Fbeacon_mac.bin\") from a remote server. If this fails, it employs the aforementioned DNS TXT delivery, sets up persistence using a LaunchAgent, and then starts the executable in a detached process. The Linux sample, on the other hand, is an UPX-packed ELF binary that's configured to download auxiliary payloads from a Cloudflare Worker URL (\"oob-worker[.]cf99-9b3.workers[.]dev\"), ultimately leading to the deployment of Sliver, an open-source command-and-control (C2) framework. The packages have also been found to contain a file called \"lib\u002Ftelemetry.js\" that implements a plausible-looking telemetry SDK but also contains the same downloader logic. \"The package entry point does not import this file, and it contains no additional hard-coded infrastructure,\" OpenSourceMalware said. \"The oversized telemetry implementation appears intended to add noise and make the malicious behavior look like native profiling or analytics functionality during a quick review.\" The presence of domains like \"tcsbank[.]ru\" and \"cloudpayments[.]ru\" in the macOS payload indicates that the campaign could be targeting Russian financial institutions and mobile payments. It's also suspected to be an evolution of a dependency confusion campaign codenamed Moika that was observed earlier this April and saw over 250 packages published to the npm registry to steal environment information and deliver an operating system-specific second-stage payload. The development comes as Palo Alto Networks Unit 42 documented multiple campaigns targeting npm and the Python Package Index (PyPI) repository - A set of 10 npm packages that download an obfuscated cryptocurrency stealer and a remote access trojan from an external server. \"After installation, the packages export a 'getPlugin' function that constructs the URL from which the payload is downloaded as an obfuscated IIFE (Immediately Invoked Function Expression) JavaScript code embedded in a JSON object,\" Unit 42 said. \"The payload implements a crypto stealer and Remote-Access Trojan (RAT) that allows the attacker to execute arbitrary commands on the infected host.\" A set of malicious packages across npm and PyPI representing multiple distinct threat actors that are capable of cloud credential exfiltration, delivering EtherHiding blockchain-based C2 droppers, Solana cryptocurrency wallet key theft via Telegram, .env file secret exfiltration, fake-CAPTCHA social engineering remote code execution, and Discord token theft and GitHub Actions CI\u002FCD credential exfiltration. From Packages to Chrome Extensions Threat actors have also been observed using Google Chrome extensions marketed as game emulators, password managers, productivity tools, CSS inspectors, and markdown converters to turn the web browser into a web crawling proxy. The crawl commands are received remotely via a persistent WebSocket connection. \"These extensions embed an identical commercial web bandwidth-sharing SDK that connects the user's browser to a 3rd party residential proxy network for web scraping operations,\" Unit 42 said, adding it crawls pages by injecting a hidden iframe into active browser tabs, converts page content to Markdown in the background, and sends it to a remote cloud backend. The cybersecurity company noted that some of these extensions disclose the practice in their Chrome Web Store descriptions and in the privacy policies on their SaaS websites. Once installed, the third-party SDK prompts users to opt-in to the service. \"While the proxy and crawling features remain inactive if the user declines, some extensions frame this opt-in as necessary for uninterrupted service,'\" Unit 42 said. \"A notable example is InstaSkip (mdondgockboebafloibbhjofmoedmnnn), which embeds this SDK.\" Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  browser security, Developer Security, Infostealer, linux, MacOS, Malware, Open Source, Remote Access Trojan, Software Supply Chain, Windows Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fnearly-800-malicious-npm-packages.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiIEXaa59LRblZ0rcBVbKDdH4w9Rszk27anNt20Onx7Li8D7FXbf3Ipod53uo3N2aa6Hj1QLJaNFDIBlrcgM3YZg0UJCsjI3maDKkFEdOeyhzis15St3QDg6WCXcYlbDRlw2WvgiOH-BL_v8I21QoSTE9kmJzzKqQwstqn11JWkAL1_9W41ZF04T-9ImaiL\u002Fs1600\u002Fnpms.jpg","2026-08-07T18:48:17+00:00","2026-08-07T20:00:21.582593+00:00",9,[18,21,23,25,27,29],{"name":19,"type":20},"npm","technology",{"name":22,"type":20},"Cloudflare Workers",{"name":24,"type":20},"DNS TXT records",{"name":26,"type":20},"ETW",{"name":28,"type":20},"AMSI",{"name":30,"type":31},"Sliver","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,62,64,67,70,73,76,79,82,84,87],{"type":57,"value":58,"context":59},"domain","oob-worker.cf103-070.workers.dev","Cloudflare Workers domain for initial payload download",{"type":57,"value":61,"context":59},"oob-worker.cf102-baf.workers.dev",{"type":57,"value":63,"context":59},"oob-worker.cf99-9b3.workers.dev",{"type":57,"value":65,"context":66},"wel1.ru","Fallback domain for next-stage payload delivery via DNS TXT records",{"type":57,"value":68,"context":69},"sdk.dl.wel1.ru","Linux x64 payload delivery domain",{"type":57,"value":71,"context":72},"ext.dl.wel1.ru","Linux ARM64 payload delivery domain",{"type":57,"value":74,"context":75},"pkg.dl.wel1.ru","macOS payload delivery domain",{"type":57,"value":77,"context":78},"net.dl.wel1.ru","Windows payload delivery domain",{"type":57,"value":80,"context":81},"tcsbank.ru","Potential target domain found in macOS payload",{"type":57,"value":83,"context":81},"cloudpayments.ru",{"type":36,"value":85,"context":86},"WEL1DROPPER","Name of the initial downloader malware",{"type":36,"value":30,"context":88},"Open-source C2 framework deployed on Linux"]