Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
A large-scale campaign has injected nearly 800 malicious npm packages into the registry, designed to distribute a potent cross-platform Remote Access Trojan (RAT) and infostealer to Windows, macOS, and Linux systems.
A significant campaign has been uncovered within the npm registry, involving nearly 800 malicious packages designed to distribute a potent cross-platform Remote Access Trojan (RAT) and infostealer. These packages, discovered by OpenSourceMalware researcher Paul McCarty, target developers using Windows, macOS, and Linux operating systems. Unlike typical supply-chain attacks that leverage pre-install or post-install scripts, this campaign instructs developers to load the malicious packages using the require() function, a common method for importing modules.
The initial stage of the attack involves a downloader named WEL1DROPPER. Upon execution, this downloader identifies the host operating system and processor architecture. It then fetches a compatible payload from one of three Cloudflare Workers domains. If the initial HTTPS downloads fail, the malware resorts to platform-specific domains and utilizes DNS TXT records to retrieve the next-stage payload from the domain "wel1[.]ru". The specific domains for payload delivery vary based on the operating system and CPU architecture, including Linux x64, Linux ARM64, macOS, and Windows.
Further analysis reveals a sophisticated download mechanism. The package first queries a TXT record from a specific domain to determine the number of payload chunks, which can range from one to two thousand. It then requests these chunks as numbered TXT records. The returned strings are concatenated and Base64-decoded to reconstruct a binary buffer. This reconstructed payload is subsequently written to a temporary folder and executed using either /bin/sh on Linux and macOS, or cmd.exe on Windows.
Sonatype, which is tracking this campaign under the name Flooding Dropper, noted that the final stage payload is launched as a detached process. For Windows systems, the malware attempts to patch Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) to evade detection and monitoring. It also checks for sandboxes and virtual environments, establishes persistence through Registry Run keys and scheduled tasks, and downloads an encrypted payload for execution.
The macOS infection chain mirrors these actions, including checks for debuggers and analysis artifacts before downloading a compatible payload. Persistence is established using a LaunchAgent, and the executable runs as a detached process. The Linux variant, however, is an UPX-packed ELF binary that downloads auxiliary payloads from a Cloudflare Worker URL, ultimately leading to the deployment of Sliver, an open-source command-and-control (C2) framework.
Adding to the complexity, the malicious packages contain a file named lib/telemetry.js. This file mimics a legitimate telemetry SDK but contains the same downloader logic. Researchers suggest this is intended to create noise and disguise the malicious behavior as native profiling or analytics functionality during initial code reviews. The presence of domains like "tcsbank[.]ru" and "cloudpayments[.]ru" within the macOS payload suggests a potential targeting of Russian financial institutions and mobile payment systems.
This campaign is suspected to be an evolution of a previous dependency confusion attack codenamed Moika, observed in April, which also involved numerous npm packages designed to steal environment information and deliver second-stage payloads. The broader trend of supply-chain attacks continues, with recent reports detailing other campaigns targeting npm and PyPI with various malware, including cryptocurrency stealers, RATs, and credential exfiltration tools.