Listen to this Post
Introduction: A New Era of Invisible Software Supply Chain Attacks
The modern software ecosystem depends on trust. Developers download packages every day from public repositories like npm, expecting that these small building blocks will help them create applications faster and more efficiently. But that trust has become one of the biggest attack surfaces in cybersecurity.
A new malware campaign has exposed how easily attackers can abuse open-source ecosystems by publishing hundreds of malicious npm packages designed to look legitimate. Nearly 800 packages were discovered carrying a powerful cross-platform malware framework capable of targeting Windows, macOS, and Linux environments.
The campaign represents a dangerous evolution in software supply chain attacks. Instead of relying only on traditional malicious installation scripts, attackers are now hiding their payloads behind realistic documentation, fake telemetry features, and AI-generated package names designed to blend into developer workflows.
The attack demonstrates a growing reality: developers are becoming the new entry point for cybercriminal operations, and a single compromised dependency can transform a trusted development environment into a malware deployment platform.
Nearly 800 npm Packages Used to Spread Cross-Platform Malware
Massive Malicious Package Operation Discovered
Security researchers identified a large-scale campaign involving almost 800 malicious packages uploaded to the npm registry. These packages were created to deliver a remote access trojan (RAT) and information-stealing malware targeting multiple operating systems.
According to researchers, many of the packages used AI-generated naming patterns, typo-squatting techniques, or meaningless package names designed to appear authentic. This approach allows attackers to exploit developers searching for popular libraries or tools.
The packages were described as “AI slop squatted” because many appeared to be automatically generated with little effort, relying on quantity rather than carefully crafted identities.
The goal was simple but effective: place hundreds of malicious options into the ecosystem and wait for developers to unknowingly install them.
Attackers Abandon Traditional npm Installation Hooks
Malicious Code Hidden Behind Developer Instructions
Previous npm supply chain attacks often depended on lifecycle scripts such as:
preinstall
install
postinstall
These scripts automatically execute when a package is installed, making them attractive for attackers. However, security tools have improved at detecting suspicious lifecycle behavior.
This campaign uses a different approach.
The malicious packages include README files instructing developers to manually load the package using JavaScript’s built-in require() function.
This technique attempts to bypass automated detection by making the malicious execution appear like normal developer behavior.
Instead of forcing execution during installation, attackers rely on social engineering and developer trust.
The attack is no longer only about compromising software. It is about manipulating human habits.
WEL1DROPPER: The Malware Engine Behind the Campaign
Cross-Platform Downloader Targets Every Major Operating System
The infection chain begins with a downloader identified as WEL1DROPPER.
After execution, the malware determines:
Operating system type
CPU architecture
Environment details
It then downloads a compatible payload from attacker-controlled infrastructure.
The malware supports:
Windows systems
macOS devices
Linux machines
This cross-platform capability makes the campaign significantly more dangerous because it is not limited to one operating environment.
The attackers built a flexible malware delivery system capable of adapting automatically depending on the victim’s machine.
Cloudflare Workers Used as Malware Delivery Infrastructure
Legitimate Cloud Services Abused for Attack Operations
The attackers used Cloudflare Workers domains to distribute malicious payloads.
The identified infrastructure included:
oob-worker.cf103-070.workers[.]dev
oob-worker.cf102-baf.workers[.]dev
oob-worker.cf99-9b3.workers[.]dev
Using cloud services provides several advantages:
Lower infrastructure costs
Easier domain replacement
Reduced detection probability
Ability to hide behind trusted providers
This reflects a wider cybersecurity trend where attackers increasingly abuse legitimate platforms instead of operating obvious malicious servers.
Cloud-based malware delivery has become one of the biggest challenges for defenders because blocking legitimate services can disrupt normal business operations.
DNS TXT Records Become a Hidden Malware Communication Channel
Attackers Use DNS as a Backup Delivery Method
When HTTPS downloads fail, the malware switches to DNS TXT record communication.
The malware requests TXT records from attacker-controlled domains and uses the returned information to rebuild the next-stage payload.
The process works by:
Requesting TXT records.
Reading the number of payload fragments.
Downloading numbered TXT records.
Combining the data.
Decoding the Base64 content.
Executing the malware.
Target payload domains include:
Linux x64: sdk.dl.wel1[.]ru
Linux ARM64: ext.dl.wel1[.]ru
macOS: pkg.dl.wel1[.]ru
Windows: net.dl.wel1[.]ru
DNS-based malware delivery is attractive because DNS traffic is often allowed through corporate networks.
Windows Malware Uses Advanced Evasion Techniques
AMSI and ETW Bypass Increase Stealth
The Windows version of the malware performs several advanced actions after execution.
Researchers observed capabilities including:
Anti-analysis checks
Virtual machine detection
Sandbox detection
Persistence creation
Security monitoring interference
The malware attempts to modify:
Event Tracing for Windows (ETW)
Antimalware Scan Interface (AMSI)
These technologies are designed to help security products detect suspicious activity.
By interfering with them, attackers attempt to reduce visibility and maintain long-term access.
The malware also establishes persistence using:
Registry Run keys
Scheduled tasks
This allows the malware to restart after system reboots.
macOS Attack Chain Targets Apple Environments
LaunchAgents Used for Persistence
The macOS version follows a similar infection pattern.
The malware:
Searches for debugging tools
Detects analysis environments
Downloads additional payloads
Creates persistence mechanisms
Instead of Windows Registry keys, macOS persistence is achieved through LaunchAgents.
The final payload is retrieved as:
/pkg/beacon_mac.bin
If normal download methods fail, the malware falls back to DNS TXT delivery.
This highlights how attackers are increasingly targeting macOS environments, especially as Apple systems become more common in enterprise organizations.
Linux Systems Targeted With Sliver Command-and-Control
Open-Source Red Team Tools Turned Into Malware Weapons
The Linux payload is an UPX-packed ELF binary.
After execution, it downloads additional components through Cloudflare Workers infrastructure.
The final stage deploys Sliver, an open-source command-and-control framework.
Although Sliver is commonly used by penetration testers and security professionals, attackers increasingly abuse legitimate security tools because they provide powerful remote management capabilities.
This creates another challenge for defenders: distinguishing authorized security activity from malicious operations.
Fake Telemetry Files Used to Hide Malicious Behavior
Malware Disguised as Analytics Software
The malicious packages also contain a file named:
lib/telemetry.js
At first glance, the file appears to provide normal analytics functionality.
However, researchers discovered that it contains the same downloader logic responsible for fetching malware.
The file appears intentionally designed to confuse quick security reviews.
Attackers understand that developers rarely inspect every dependency deeply.
By hiding malicious functionality inside believable components, they increase the chance of successful infections.
Possible Financial Targeting Through Payload Infrastructure
Russian Banking References Raise Concerns
Researchers discovered references to domains associated with Russian financial services, including:
tcsbank[.]ru
cloudpayments[.]ru
These indicators suggest the campaign may have specific financial targeting objectives.
However, the malware architecture is broad enough that attackers could easily redirect operations toward different industries or geographic regions.
The infrastructure provides flexibility for future campaigns.
Connection to Previous Moika Dependency Confusion Campaign
Evolution of Earlier npm Attacks
Security researchers believe this operation may represent an evolution of the Moika campaign.
Earlier activity involved hundreds of npm packages designed to:
Collect environment information
Steal sensitive data
Deliver operating-system-specific payloads
The latest campaign expands those techniques by adding:
Better evasion
Multi-platform support
DNS fallback delivery
Cloud-based infrastructure
The attackers are clearly improving their methods.
npm and PyPI Face Growing Malware Problems
Open-Source Repositories Become Prime Attack Targets
The npm campaign is part of a larger wave affecting software repositories.
Researchers have also identified malicious packages capable of:
Cryptocurrency theft
Remote access attacks
Cloud credential theft
GitHub token theft
Environment file extraction
Blockchain-based command systems
Attackers are increasingly targeting developers because developer environments often contain valuable secrets.
These may include:
API keys
Cloud credentials
Database passwords
Source code access tokens
A compromised developer workstation can become a gateway into an entire organization.
Chrome Extensions Become Web Scraping Malware Platforms
Browser Add-ons Used as Hidden Proxy Networks
The same attack philosophy is expanding beyond package repositories.
Security researchers found Chrome extensions marketed as:
Game emulators
Password managers
Productivity tools
CSS inspectors
Markdown converters
Some extensions secretly embedded commercial bandwidth-sharing SDKs.
These SDKs transformed user browsers into residential proxy nodes used for web crawling.
The extensions maintained communication through persistent WebSocket connections and could remotely receive crawling commands.
Hidden Browser Crawling Creates Privacy Risks
Users Become Unaware Infrastructure Providers
Some extensions disclosed proxy activity in privacy policies, but researchers warned that many users may not understand the implications.
The extensions could:
Inject hidden iframes
Crawl websites
Convert content into Markdown
Send collected information to remote servers
This creates a situation where ordinary users unknowingly contribute computing resources and network access to third-party operations.
What Undercode Say:
A New Generation of Supply Chain Attacks Is Emerging
The npm Flooding Dropper campaign represents a major shift in how attackers approach software ecosystems.
Public repositories have become battlefield environments.
Attackers no longer need to compromise popular packages.
They can create thousands of fake packages and wait.
Quantity has become a weapon.
AI-generated naming makes malicious packages harder to distinguish.
Developers often trust package descriptions more than package behavior.
README files have become part of the attack chain.
Social engineering is replacing traditional exploitation methods.
The malware supports Windows, Linux, and macOS.
Cross-platform malware increases attacker return on investment.
Cloud services are becoming malware infrastructure.
Blocking Cloudflare is unrealistic for most organizations.
DNS TXT communication shows attackers continue abusing basic protocols.
DNS monitoring is becoming increasingly important.
Supply chain attacks are no longer only dependency problems.
They are identity and trust problems.
Fake telemetry is an example of psychological manipulation.
Attackers design malware to look boring.
Security teams must inspect behavior, not only names.
Open-source ecosystems need stronger verification systems.
Developers should avoid installing packages without reputation checks.
Automated dependency scanning is becoming mandatory.
Software bills of materials are becoming more important.
Package maintainers need stronger account protection.
Multi-factor authentication should become standard.
Organizations should monitor developer endpoints.
Secrets should never exist unprotected inside development machines.
Attackers understand developers have valuable access.
The weakest dependency can become the strongest attack path.
Security monitoring must include developer tools.
Browser extensions represent another supply chain problem.
Users rarely inspect extension permissions.
Legitimate functionality can hide abusive behavior.
Cybercriminals increasingly exploit trust instead of vulnerabilities.
The future of cybersecurity will focus on verification.
Every package, extension, and dependency must be treated as potentially risky.
The open-source ecosystem needs stronger collective defense.
Attackers move faster than traditional security models.
Organizations must adopt continuous monitoring.
Trust must be earned through transparency and verification.
Deep Analysis: Investigating Malicious npm Packages
Security teams can analyze suspicious packages using Linux tools:
Download npm package for inspection npm pack suspicious-package
Extract package contents
tar -xvf suspicious-package.tgz
Search suspicious JavaScript functions
grep -R child_process .
Search network activity indicators
grep -R workers.dev .
Search encoded payloads
grep -R base64 .
Check package metadata
cat package.json
Monitor DNS requests
sudo tcpdump -i any port 53
Monitor outbound connections
sudo lsof -i -P -n
Analyze running processes
ps aux | grep node
Check persistence locations
ls -la ~/.config/autostart ls -la /etc/systemd/system
Security researchers should also:
Review package reputation.
Verify maintainers.
Compare package behavior with documentation.
Monitor unexpected network connections.
Scan developer environments regularly.
✅ The discovery of hundreds of malicious npm packages delivering cross-platform malware has been reported by cybersecurity researchers.
✅ The campaign uses downloader malware, Cloudflare Workers infrastructure, DNS TXT delivery, and operating-system-specific payloads.
❌ There is currently no confirmed evidence that every package was downloaded or that every referenced financial organization was successfully targeted.
Prediction
(+1) Software supply chain attacks will continue increasing as attackers discover that developers provide valuable access to corporate networks.
(+1) More security companies will develop AI-based package reputation systems to identify suspicious open-source projects.
(+1) Organizations will adopt stricter dependency approval processes.
(-1) Public repositories like npm and PyPI will remain attractive targets because millions of developers depend on them daily.
(-1) Attackers will continue abusing trusted cloud services because defenders cannot simply block major platforms.
(-1) Browser extensions will become a larger privacy and security threat as users install more AI, productivity, and automation tools.
▶️ Related Video (80% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
