Russian AI Slopsquatting Campaign Floods npm With Malicious Packages Targeting Developers

A large-scale supply chain attack in which a suspected Russian threat actor published more than 700 malicious packages to the npm registry within just 48 hours.

The campaign documented by opensourcemalware, tracked as WEL1DROPPER, is now growing beyond 1,000 packages, and marks a new evolution in “AI slopsquatting,” using randomly generated, AI-hallucinated package names to trick developers into installing malware.

Unlike typical npm supply chain attacks that rely on preinstall or postinstall lifecycle hooks, these packages require none. A README instructs developers to load the package with a simple require("checkout-mobile-bnpl") call, and that single import triggers the infection chain via a bundled _helpers.js file that runs automatically.

Russian AI Slopsquatting Campaign Floods npm

The packages masquerade as small mobile SDKs (with fake init(), version(), and configure() methods) but hide their real payload beneath a harmless-looking export statement.

Once imported, the downloader fingerprints the victim’s OS and CPU architecture and requests a matching native payload from one of three rotating Cloudflare Workers hosts (oob-worker.cf103-070, cf102-baf, and cf99-9b3.workers.dev).

If all HTTPS attempts fail, it falls back to a covert channel by reconstructing the payload from Base64-encoded chunks stored in DNS TXT records on platform-specific subdomains of wel1.ru.

This dual-channel design is notable because DNS monitoring tools that only flag known tunneling tools may miss ordinary-looking TXT lookups.

The dropped executable is written to disguised filenames .cache_<hex> on Linux/macOS and dotnet_diag_<hex>.exe on Windows and launched as a detached background process, with a fake “analytics” marker file used purely as a six-hour rate-limit switch.

Analysis of the native binaries shows that the Linux payload is a UPX-packed, statically linked ELF, while the macOS payload is a universal Mach-O binary that supports Intel and Apple Silicon.

The macOS stage goes further: it checks for debuggers (lldb, frida, dtrace), VMware artifacts, and low memory before installing a disguised LaunchAgent (com.apple.windowserver.helper.plist) for persistence, then retrieves a third-stage payload and a still-unrecovered beacon through additional Cloudflare Workers proxies.

The Linux binary’s final stage reportedly delivers what may be a Sliver implant, the open-source red-team C2 framework often abused by real-world threat actors, though this remains unconfirmed.

Paul McCarty attributes the campaign to a Russian actor with moderate confidence, citing the .ru C2 domain and XOR-obfuscated strings referencing Russian financial institutions like tcsbank.ru and cloudpayments.ru, likely used as decoy health-check traffic.

OSM link WEL1DROPPER to the earlier Moika campaign (250+ npm packages, April–May 2026) based on shared tradecraft, including “oob”-named infrastructure, fake telemetry camouflage, and similar kill-switch mechanisms.

This campaign underscores that install-script restrictions alone don’t stop npm malware a single require() call during development or testing is enough to trigger infection.

Defenders are advised to prioritize the identified domains, DNS query patterns, and dropped-file naming conventions over static IP blocklists, as the Cloudflare Workers infrastructure is dynamic.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR   

The post Russian AI Slopsquatting Campaign Floods npm With Malicious Packages Targeting Developers appeared first on Cyber Security News.