Software Supply Chain Under Siege: Massive NPM Campaign Deploys Cross-Platform RATs via AI-Generated "Slop-Squatting"

Executive Overview

Tracked variously as WEL1DROPPER by OpenSourceMalware and Flooding Dropper by Sonatype, this aggressive operation represents a significant evolution in malicious package distribution. Unlike traditional supply chain attacks that rely on automated installation scripts—such as preinstall or postinstall lifecycle hooks—this campaign adopts a social engineering and instruction-based delivery mechanism. Attackers have populated the npm registry with randomized, AI-generated typo-squatted names (colloquially referred to as "AI slop-squatting"), complete with README files that deliberately dupe developers into manually loading the malicious modules via Node.js’s native require() function.

Once invoked, the dropper profiles the host operating system and system architecture before fetching stage-two payloads via resilient, multi-tiered infrastructure leveraging Cloudflare Workers and fallback DNS TXT records. The resulting infections deploy evasion routines, sandbox checks, persistence mechanisms, and open-source command-and-control (C2) frameworks like Sliver. Furthermore, security analysts have linked this aggressive onslaught to an evolution of the earlier "Moika" dependency confusion campaign, while parallel investigations highlight a broader, cross-ecosystem threat landscape where threat actors simultaneously weaponize Python’s PyPI repository and commercial web-scraping SDKs embedded within malicious Google Chrome extensions.

Detailed Chronology & Attack Mechanics

1. Infiltration and the "AI Slop-Squatting" Vector

The campaign kicked off with the automated or semi-automated generation of nearly 800 distinct packages uploaded directly to the public npm registry. According to Paul McCarty, a researcher at OpenSourceMalware, these packages exploit the sheer volume of modern software dependencies by utilizing randomized or AI-generated typo-squatted names.

Instead of embedding malicious triggers directly into standard npm hooks—which are routinely scrutinized by automated package-registry security scanners—the authors designed the packages to remain inert until explicitly called. The inclusion of a benign-looking or deceptive README file directs developers to import the package using the native Node.js command:

const maliciousPackage = require('typo-squatted-name');

This simple instruction initiates the malicious sequence without raising immediate flags during automated installation audits, tricking developers into integrating the code directly into local build scripts or applications.

2. Execution of the WEL1DROPPER Downloader

Once the require() function executes the package, it calls upon an internal downloader mechanism designated as WEL1DROPPER.

• Reconnaissance: The script immediately queries the underlying operating system and central processor architecture (Windows, macOS, or Linux).
• Primary Fetch: It attempts to retrieve a compatible payload from one of three distinct Cloudflare Workers hosts via HTTPS.
• Resilient Fallback: If the primary HTTPS connection fails, the malware pivots to a platform-specific domain, employing DNS TXT records routed through the .ru top-level domain (wel1[.]ru) to fetch its next stage.

McCarty detailed the intricate DNS retrieval process: "The package first requests a TXT record from c.<domain>. It parses the response as the number of payload chunks, accepting a value between 1 and 2,000. It then requests numbered TXT records. The returned strings are joined together and Base64-decoded into a binary buffer."

In the final preparatory stage, this decoded binary buffer is written directly to a temporary directory on the host machine and executed via /bin/sh on Unix-like systems (Linux and macOS) or via cmd.exe on Windows environments.

3. Platform-Specific Infection Chains

Independent analysis by Sonatype highlights the modular and highly tailored nature of the final-stage payloads deployed across different operating systems:

• Windows Payload (update_win.exe): Launched as a detached process, the Windows variant actively works to blind security tooling. It patches Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) to disrupt telemetry and monitoring. It also performs rigorous checks for sandboxes and virtualized environments to evade analysis, establishes persistence via Registry Run keys and scheduled tasks, and downloads an encrypted secondary payload.
• macOS Payload (beacon_mac.bin): The Apple ecosystem variant mirrors many of the Windows defenses. It scans the system for debuggers and analysis artifacts, leverages DNS TXT fallback mechanisms if remote server connections fail, creates persistence via a native LaunchAgent, and executes the core beacon within a detached process. Intriguingly, the presence of domains such as tcsbank[.]ru and cloudpayments[.]ru within the macOS payloads strongly indicates that the campaign may harbor specific targeting intentions against Russian financial institutions and mobile payment platforms.
• Linux Payload (UPX-Packed ELF): Linux targets encounter an UPX-packed ELF binary. Once unpacked, it pulls auxiliary payloads from dedicated Cloudflare Worker instances (oob-worker[.]cf99-9b3.workers[.]dev), culminating in the deployment of Sliver—a prominent, open-source adversary emulation and C2 framework increasingly favored by both red teams and cybercriminal syndicates.

4. Obfuscation via Dummy Telemetry

To bypass human code reviews and automated analysis, the malicious packages also ship with a file named lib/telemetry.js. This file implements a fully functional, plausible-looking telemetry SDK combined with the core downloader logic.

However, the main package entry point does not import this telemetry file, and it contains no hard-coded infrastructure of its own. Security analysts note that this oversized implementation is a deliberate anti-analysis maneuver, designed to generate cryptographic and structural noise, making the malicious code blend seamlessly with native profiling or analytics utilities during a cursory audit.

Supporting Context & Metrics

The sheer scale of this npm campaign underscores a systemic vulnerability within modern software supply chains. Open-source repositories, prized for their accessibility and decentralized nature, remain prime targets for state-sponsored and financially motivated threat actors alike.

• Volume: Nearly 800 packages were identified in this single wave, dwarfing historical targeted attacks and illustrating automated generation pipelines at play.
• Evolution of "Moika": Security analysts connect this campaign directly to an earlier April operation codenamed Moika, which utilized over 250 npm packages to perform dependency confusion, harvest environment variables, and drop operating system-specific payloads.
• Cross-Repository Assaults: Palo Alto Networks Unit 42 recently released intelligence documenting coordinated, multi-vector campaigns targeting both npm and the Python Package Index (PyPI). Threat actors are no longer relying on a single vector; they are diversifying across language ecosystems to maximize enterprise and developer exposure.

Expanding Threat Vectors: From Packages to Chrome Extensions

While software registries remain a primary battleground, threat actors continue to diversify their delivery mechanisms across the broader web application ecosystem. Recent investigations by Unit 42 have exposed parallel campaigns where browser extensions are weaponized to transform everyday user browsers into proxy nodes.

Attackers have published malicious Google Chrome extensions marketed benignly as:

• Game emulators
• Password managers
• Productivity suites
• CSS inspectors
• Markdown converters

The Browser-as-a-Proxy Scheme

Once installed, these extensions embed a commercial web bandwidth-sharing SDK. This SDK connects the victim’s browser directly to a third-party residential proxy network designed for covert web scraping and data harvesting operations.

[Malicious Chrome Extension Installed]
       │
       ▼
[Commercial Bandwidth-Sharing SDK Activated]
       │
       ▼
[Persistent WebSocket Connection Established with C2]
       │
       ▼
[Hidden iFrames Injected into Active Tabs -> Content Scraped & Converted to Markdown]
       │
       ▼
[Data Exfiltrated to Remote Cloud Backend]

According to Unit 42, the extensions crawl active web pages by dynamically injecting hidden iFrames into active browser tabs. They convert page content into Markdown formats in the background and silently exfiltrate the data to a remote cloud backend via persistent WebSocket connections.

While some of these extensions technically disclose their data-sharing practices within their Chrome Web Store descriptions or convoluted SaaS privacy policies, they rely on aggressive social engineering. For example, extensions like InstaSkip (mdondgockboebafloibbhjofmoedmnnn) prompt users to "opt-in" upon installation. If a user declines, the extension frames the data-sharing feature as a mandatory requirement for uninterrupted service, effectively coercing consent and turning millions of unsuspecting user sessions into automated crawling bots.

Future Outlook and Defensive Recommendations

The convergence of AI-generated typo-squatting, multi-tiered infrastructure (Cloudflare Workers paired with DNS TXT record lookups), and cross-ecosystem browser extension exploitation signals a maturation of modern cybercriminal supply chain tactics. Traditional perimeter defenses and reactive signature scanning are no longer sufficient to protect development pipelines or end-user environments.

To mitigate these evolving risks, security leaders and development teams must adopt a Zero-Trust approach to open-source consumption:

1. Strict Dependency Pinning & Auditing: Organizations should maintain a strict inventory of all open-source dependencies (Software Bill of Materials – SBOM), auditing every newly introduced package for anomalous author metrics, recent publication dates, and unverified maintainer profiles.
2. Behavioral Monitoring: Security operations centers (SOCs) must monitor endpoint activity for unexpected execution of native binaries (cmd.exe, /bin/sh) spawned directly out of temporary local node module directories.
3. EDR Hardening: Endpoint Detection and Response (EDR) solutions should be configured to flag and block attempts to tamper with critical monitoring APIs, such as Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI).
4. Browser Extension Governance: Enterprises must enforce strict browser policies via centralized mobile device management (MDM) or enterprise policies to restrict the installation of unvetted third-party Chrome extensions, mitigating the risk of browser-as-a-proxy data exfiltration schemes.

As threat actors continue to weaponize the building blocks of modern software and web browsing, continuous vigilance, automated dependency scanning, and developer education remain the first and best lines of defense.