Hundreds of look-alike software packages are sneaking remote access tools and password stealers onto developer machines running all three major desktop operating systems.
OpenSourceMalware researcher Paul McCarty identified roughly 800 malicious modules on the npm registry using randomly generated typo-squatting names that resemble AI-generated filler. Instead of abusing install lifecycle hooks, the packages instruct developers to load them with require(), and running that code triggers a JavaScript file with the malicious logic, delivering a downloader tracked as WEL1DROPPER.
The downloader profiles the host and fetches a compatible payload from Cloudflare Workers hosts, falling back to DNS text records on wel1.ru if that route fails. The next stage arrives in numbered chunks that are joined and decoded into a binary.
Windows samples patch Event Tracing for Windows and Antimalware Scan Interface, while the Linux variant is an UPX-packed ELF that installs Sliver, an open-source command-and-control framework.
Sonatype counts 850 packages and calls the campaign Flooding Dropper. On macOS the delivered stage is beacon_mac.bin, run after the chain probes for debuggers and analysis artifacts; it registers a LaunchAgent to survive reboots and detaches from the parent process.
Domains tied to Russian financial institutions inside the macOS payload suggest banks and mobile payment services are the intended marks, and researchers link the operation to an April dependency confusion campaign called Moika. Developers should audit package names and avoid loading unexpected modules.
