Affected Systems

npm registry: ~800 packages using typosquatting and AI-generated names. Targets all Node.js developers on Windows, macOS (x64/ARM64), and Linux (x64/ARM64). Delivers WEL1DROPPER leading to Sliver C2 framework and platform-specific infostealers. Likely evolution of April 2026 "Moika" campaign.

Exploitation Status

Active campaign. Packages published to npm registry and available for download. Malware infrastructure operational via Cloudflare Workers (oob-worker.cf103-070, cf102-baf, cf99-9b3.workers.dev) and DNS TXT records at wel1[.]ru domain. Final payloads include Sliver C2 framework (Linux) and custom RAT/infostealers (Windows/macOS).

Business Impact

Developers installing typosquatted packages face immediate compromise across all major platforms. Windows payloads disable ETW and AMSI, establish Registry and scheduled task persistence. macOS payloads use LaunchAgent persistence. Linux systems receive Sliver C2 implants. All variants exfiltrate credentials and environment variables. Russian financial institutions (tcsbank.ru, cloudpayments.ru) appear to be specific targets. Unlike typical npm attacks, these require manual require() calls per README instructions, reducing automatic infection but increasing stealth.

Urgency

🔴 Immediate

Recommended Actions

  • Audit package.json and node_modules for typosquatted packages; cross-reference against known-good package names and verify publisher identity before installation
  • Block network access to oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and wel1[.]ru at firewall and DNS resolver
  • Hunt for WEL1DROPPER artifacts: /tmp executables launched via /bin/sh (Linux/macOS), cmd.exe child processes writing to temp folders (Windows), LaunchAgent persistence (macOS), Registry Run keys and scheduled tasks (Windows)
  • Monitor DNS queries for TXT record requests to subdomains of wel1[.]ru (sdk.dl, ext.dl, pkg.dl, net.dl) and Cloudflare Worker domains
  • Enable npm audit in CI/CD pipelines and enforce package signature verification; consider private registry mirroring with manual vetting for new dependencies

---

# Threat Actor Context

Actor Profile

This campaign, tracked as "Flooding Dropper" by Sonatype, represents an unattributed coordinated supply chain operation targeting the npm registry. The threat actor demonstrates advanced capabilities in cross-platform malware development and evasion techniques. Motivation appears financially driven, with indicators suggesting potential targeting of Russian financial institutions (presence of tcsbank[.]ru and cloudpayments[.]ru domains in payloads). The campaign is suspected to be an evolution of the "Moika" dependency confusion campaign observed in April 2026, which used similar tactics to deliver OS-specific payloads. The actor shows sophistication in operational security, using AI-generated and typosquatted package names, multiple fallback C2 channels (Cloudflare Workers, DNS TXT records), and platform-specific evasion techniques.

TTPs (Tactics, Techniques, Procedures)

The campaign employs supply chain compromise via malicious npm packages (T1195.002). Initial execution relies on social engineering through README instructions to manually require() modules rather than automated lifecycle hooks, evading common detection patterns (T1204.003). The WEL1DROPPER downloader performs system discovery (T1082) to identify OS and architecture, then retrieves second-stage payloads via HTTPS from Cloudflare Workers with DNS TXT record fallback (T1071.001, T1071.004). Windows payloads implement defense evasion through ETW and AMSI patching (T1562.001), anti-sandbox checks (T1497), and establish persistence via Registry Run keys and scheduled tasks (T1547.001, T1053.005). macOS variants use LaunchAgents for persistence (T1543.001) and perform debugger detection (T1622). Linux payloads deploy Sliver C2 framework (T1219). All variants execute as detached processes and exfiltrate credentials and system information (T1552.001, T1005).

Targets & Patterns

The campaign primarily targets software developers and the open-source community, specifically those using the npm ecosystem for JavaScript/Node.js development. The use of typosquatting and AI-generated package names suggests opportunistic targeting of developers who mistype popular package names or fail to verify package authenticity. The cross-platform nature (Windows, macOS, Linux) indicates targeting of diverse development environments. Evidence within macOS payloads (tcsbank[.]ru, cloudpayments[.]ru domains) suggests secondary targeting of Russian financial institutions and mobile payment systems, potentially for credential theft or financial fraud. The campaign's scale (nearly 800 packages) and sophisticated evasion techniques indicate an intent to maximize infection rates across the developer community, likely for credential harvesting, intellectual property theft, or establishing persistent access to software supply chains.

Historical Context

This campaign represents an evolution of the "Moika" dependency confusion operation observed in April 2026, which published over 250 malicious npm packages to steal environment information and deliver OS-specific payloads. The current campaign scales up significantly (nearly 800 packages) and introduces more sophisticated delivery mechanisms, including DNS TXT record-based payload retrieval and platform-specific defense evasion. The shift from automated lifecycle hooks (preinstall/postinstall) to manual require() instructions represents tactical adaptation to evade detection systems focused on traditional npm supply chain attacks. The campaign aligns with broader trends documented by Unit 42 showing multiple threat actors simultaneously targeting npm and PyPI repositories with various malware families including cryptocurrency stealers, RATs, and credential exfiltration tools. The use of Sliver C2 framework in Linux variants follows an industry trend of threat actors adopting legitimate open-source offensive security tools.

Defensive Recommendations

  • Monitor npm package installations for typosquatted names and newly published packages with low download counts; implement package verification workflows requiring manual approval for new dependencies
  • Detect T1562.001 defense evasion by monitoring for ETW/AMSI patching attempts via PowerShell logging (Event ID 4104) and Sysmon Event ID 7 (ImageLoad) for suspicious module loads into security processes
  • Block or monitor DNS TXT record queries to unusual domains (particularly *.wel1[.]ru) and outbound connections to Cloudflare Workers domains matching pattern oob-worker.cf*-*.workers[.]dev
  • Detect T1543.001 and T1547.001 persistence mechanisms by monitoring LaunchAgent creation on macOS (/Library/LaunchAgents, ~/Library/LaunchAgents) and Registry Run key modifications on Windows (HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run)
  • Implement application allowlisting to prevent execution of binaries from temporary directories (/tmp, %TEMP%) and monitor for detached process creation patterns using process monitoring tools
  • Deploy Sliver C2 detection signatures and monitor for characteristic network traffic patterns; inspect outbound HTTPS connections for Sliver beaconing behavior and unusual User-Agent strings