Russian Hackers Use AI Slopsquatting to Publish 700+ Malicious npm Packages

A large-scale supply chain attack has hit the npm registry, with a suspected Russian threat actor publishing more than 700 malicious packages in just 48 hours.

Researcher Paul McCarty documented the campaign, tracked as WEL1DROPPER, and the package count has since grown past 1,000.

WEL1DROPPER marks an evolution in AI slopsquatting, where attackers register randomly generated, AI-hallucinated package names that coding assistants tend to suggest to unsuspecting developers.

Russian Hackers Use AI Slopsquatting

Unlike typical npm supply chain attacks that abuse preinstall or postinstall lifecycle hooks, these packages need no install script at all.

A README simply instructs developers to run a require("checkout-mobile-bnpl") call, and that single import triggers the infection chain through a bundled _helpers.js file that executes automatically.

The packages pose as small mobile SDKs, complete with fake init(), version(), and configure() methods, while burying the actual payload beneath an innocuous-looking export statement.

Once imported, the downloader fingerprints the victim’s operating system and CPU architecture, then requests a matching native payload over HTTPS from one of three rotating Cloudflare Workers hosts.

If all three attempts fail, the malware falls back to a covert channel, reconstructing the payload from Base64-encoded chunks stored in DNS TXT records under platform-specific subdomains of wel1.ru.

This dual-channel design is significant because DNS monitoring tools tuned only to known tunneling signatures can easily miss ordinary-looking TXT lookups.

The dropped executable is saved under disguised filenames, .cache_<hex> on Linux and macOS, and dotnet_diag_<hex>.exe on Windows, then launched as a detached background process. A fake “analytics” marker file serves purely as a six-hour rate-limit switch to avoid re-triggering the chain.

Analysis of the native binaries shows the Linux payload is a UPX-packed, statically linked ELF file, while the macOS payload is a universal Mach-O binary supporting both Intel and Apple Silicon.

The macOS stage is notably more advanced: it checks for debuggers such as lldb, frida, and dtrace, scans for VMware artifacts and low memory, then installs a disguised LaunchAgent (com.apple.windowserver.helper.plist) for persistence before retrieving a third-stage payload.

The Linux binary’s final stage reportedly delivers what may be a Sliver implant, the open-source red-team command-and-control framework frequently abused by real-world threat actors, though this remains unconfirmed.

McCarty attributes WEL1DROPPER to a Russian actor with moderate confidence, citing the .ru command-and-control domain and XOR-obfuscated strings referencing Russian financial institutions like tcsbank.ru and cloudpayments.ru, likely used as decoy health-check traffic.

OpenSourceMalware links WEL1DROPPER to the earlier Moika campaign, which pushed 250-plus npm packages between April and May 2026, based on shared tradecraft including “oob”-named infrastructure, fake telemetry camouflage, and similar kill-switch mechanisms.

The campaign underscores that install-script restrictions alone don’t stop npm malware; a single require() call during development or testing is enough to trigger infection.

Defenders are advised to prioritize the identified domains, DNS query patterns, and dropped-file naming conventions over static IP blocklists, since the underlying Cloudflare Workers infrastructure is dynamic and can rotate at any time.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world