Flooding Dropper malicious npm package campaign targeting Windows, Mac, and Linux
Campaign
Summary
Hide ▲
Show ▼
A new npm supply-chain campaign has published nearly 800 malicious packages to push RAT and infostealer payloads onto Windows, Mac, and Linux systems. The packages use a README-driven require() path instead of the more common lifecycle-hook trigger, which helps the delivery blend into normal developer workflows. The operation is tracked as Flooding Dropper and appears to extend a prior Moika package-publishing pattern. The malware chain uses Cloudflare Workers, wel1[.]ru DNS TXT delivery, and platform-specific payloads to reach infected hosts.
Related Happenings
WEL1DROPPER cross-platform RAT and infostealer delivery chain
Malware Activity
H score36
First: 07.08.2026 21:48
Last: 07.08.2026 21:48
Sources 1
How related:
The attack leads to the execution of a downloader named WEL1DROPPER, which, when executed, identifies the host operating system and processor architecture and fetches a compatible payload from one of the three Cloudflare Workers hosts.
About this happening:
The WEL1DROPPER malware chain is delivering RAT and infostealer payloads through nearly 800 malicious npm packages, expanding cross-platform risk for Windows, macOS,...
WEL1DROPPER cross-platform RAT and infostealer delivery chain
Malware ActivityHow related: The attack leads to the execution of a downloader named WEL1DROPPER, which, when executed, identifies the host operating system and processor architecture and fetches a compatible payload from one of the three Cloudflare Workers hosts.
About this happening: The WEL1DROPPER malware chain is delivering RAT and infostealer payloads through nearly 800 malicious npm packages, expanding cross-platform risk for Windows, macOS,...
Rollup polyfill npm package malware activity for remote access and data theft
Malware Activity
H score16
First: 03.07.2026 19:07
Last: 03.07.2026 19:07
Sources 1
About this happening:
Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
Rollup polyfill npm package malware activity for remote access and data theft
Malware ActivityAbout this happening: Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
IronWorm npm supply-chain infection and self-propagation
Malware Activity
H score15
First: 04.06.2026 18:25
Last: 04.06.2026 18:25
Sources 1
About this happening:
IronWorm is a Rust infostealer in a npm supply-chain activity that hides behind an eBPF kernel rootkit, communicates over Tor, and targets 86 environment var...
IronWorm npm supply-chain infection and self-propagation
Malware ActivityAbout this happening: IronWorm is a Rust infostealer in a npm supply-chain activity that hides behind an eBPF kernel rootkit, communicates over Tor, and targets 86 environment var...
Shai-Hulud worm clone activity on NPM
Malware Activity
H score69
First: 18.05.2026 12:45
Last: 18.05.2026 12:45
Sources 1
About this happening:
ChainDrop is a Shai-Hulud-based npm supply-chain campaign that began on August 4 after attackers compromised a maintainer’s GitHub account for the keyv key sto...
Shai-Hulud worm clone activity on NPM
Malware ActivityAbout this happening: ChainDrop is a Shai-Hulud-based npm supply-chain campaign that began on August 4 after attackers compromised a maintainer’s GitHub account for the keyv key sto...
TeamPCP Mini Shai-Hulud npm supply-chain campaign
Campaign
H score75
First: 12.05.2026 14:07
Last: 12.05.2026 14:07
Sources 1
About this happening:
The TeamPCP-linked Mini Shai-Hulud campaign is an active npm supply-chain operation that steals developer credentials and abuses trusted publishing paths to spread trojani...
TeamPCP Mini Shai-Hulud npm supply-chain campaign
CampaignAbout this happening: The TeamPCP-linked Mini Shai-Hulud campaign is an active npm supply-chain operation that steals developer credentials and abuses trusted publishing paths to spread trojani...
Timeline
-
07.08.2026 21:48 2 articles · 2h ago
Flooding Dropper uses nearly 800 malicious npm packages to deliver RAT and infostealer payloads
Initial DisclosureFlooding Dropper is a campaign that published nearly 800 malicious packages to the npm registry and uses AI-slop typo-squatted names plus a README that tells developers to load the package with `require()`. Executing the package launches WEL1DROPPER, which fingerprints the host OS and CPU architecture, fetches a matching payload from Cloudflare Workers or falls back to `wel1[.]ru` DNS TXT records, and then runs the final stage. The Windows payload patches ETW and AMSI, checks for sandboxes and virtual environments, and establishes persistence with a Registry Run key and a scheduled task; the macOS chain looks for debuggers and analysis artifacts, retrieves `/pkg/beacon_mac.bin`, and uses a LaunchAgent; the Linux chain can deploy Sliver. The package set also includes `lib/telemetry.js` to hide the malicious downloader logic, and the presence of `tcsbank[.]ru` and `cloudpayments[.]ru` suggests possible targeting of Russian financial institutions and mobile payments.
Show sources
- Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — thehackernews.com — 07.08.2026 21:48
- Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — thehackernews.com — 07.08.2026 21:48