Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT Targeting Windows, Mac, and Linux
A large-scale malicious package campaign has been uncovered on the npm registry, with nearly 800 packages designed to deliver cross-platform remote access trojans and information stealers to developers’ systems.
- Close to 800 malicious npm packages use README instructions to trick developers into running malware
- The malware, named WEL1DROPPER, fetches OS-specific payloads from Cloudflare Workers servers
- The macOS variant checks for debuggers and analysis tools before downloading the payload
- Some domains point to Russian financial institutions as potential targets
An unconventional attack: using README as the delivery mechanism
Unlike typical npm supply chain attacks that use lifecycle hooks such as preinstall or postinstall to automatically execute malicious code, this campaign took a different approach. According to OpenSourceMalware researcher Paul McCarty, the packages include README files that directly instruct developers to load and execute the malicious module, bypassing conventional security scanning mechanisms.
The package names use AI-generated or randomly generated typo-squatted strings designed to mimic popular package names and mislead developers.
WEL1DROPPER: a layered attack architecture
Once a developer follows the README instructions and executes the malicious code, a downloader called WEL1DROPPER activates. The program first identifies the host operating system and processor architecture, then fetches a compatible payload from one of three Cloudflare Workers servers.
If HTTPS downloads fail, the malware switches to a fallback mechanism, using DNS TXT records to retrieve the next-stage payload in chunks from a specific domain (wel1[.]ru). McCarty explained that the malware first requests a TXT record to obtain the chunk count, which can range from 1 to 2,000, then retrieves each chunk sequentially and reassembles them into the final payload.
macOS and Linux are also in the crosshairs
According to analysis by cybersecurity firm Sonatype, the macOS infection chain mirrors the Windows version, checking for debuggers and analysis artifacts before downloading the payload from a remote server. If the primary download fails, it employs the same DNS TXT record fallback.
The Linux sample is a UPX-packed ELF binary that ultimately deploys Sliver, an open-source command-and-control framework frequently used by attackers as a post-exploitation tool.
Targets and origins
Researchers identified Russian-associated domains such as tcsbank[.]ru and cloudpayments[.]ru in the macOS payload, suggesting the campaign may be targeting Russian financial institutions and mobile payment systems. The operation is also suspected to be an evolution of a dependency confusion campaign codenamed Moika, observed earlier in April, which saw over 250 packages published to npm.
Palo Alto Networks Unit 42 has concurrently documented multiple campaigns targeting both npm and the Python Package Index, underscoring the growing security threats facing open-source package ecosystems.
Source: The Hacker News
