Executive Summary
- •Nearly 800 malicious npm packages deliver cross-platform RAT and infostealer malware.
- •Attacks bypass lifecycle hooks and instruct developers to load modules via require statements.
- •Uses WEL1DROPPER to fetch OS-specific payloads from Cloudflare Workers and DNS TXT records.
Community Sentiment
Key Developments & Data
Nearly 800 malicious npm packages deliver cross-platform malware targeting Windows, Mac, and Linux systems.
OpenSourceMalware identified a campaign where packages use AI-generated typosquatting names to deliver a RAT and infostealer.
Unlike typical supply chain attacks, the code instructs developers to load packages using require functions rather than lifecycle hooks.
The WEL1DROPPER payload retrieves platform-specific binaries using Cloudflare Workers or fallback DNS TXT records.
Sonatype tracks the campaign as Flooding Dropper, noting Linux versions deploy the open-source Sliver command-and-control framework.
"These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload." — Paul McCarty
Zubiqo Intelligence Briefing
Get the unfiltered signal before markets open.
Top tech breakthroughs, venture funding, and market moves—synthesized into a 2-minute morning read. Zero PR fluff.
✓ 100% Free•✓ 1-click unsubscribe•✓ No spam ever
Zubiqo Strategic Assessment
Primary Impact
Node.js developers and enterprise engineering teams managing open-source dependencies on npm.
Strategic Shift
Attacker tactics shifting from aggressive preinstall scripts to passive, disguised require imports paired with AI-generated typosquatting.
The Ripple Effect
Automated dependency scanning tools will mandate deeper inspection of module entry points and DNS TXT record queries over the next 6-12 months.
This intelligence assessment is generated by Zubiqo's AI for informational purposes only.
