A new and significant threat has emerged in the form of nearly 800 malicious packages published on the npm registry. This campaign is designed to distribute cross-platform malware, targeting systems running Windows, macOS, and Linux. The packages, which utilize typo-squatting techniques with randomly generated names, deliver a remote access trojan (RAT) and infostealer payload. Unlike other npm-based attacks that exploit lifecycle hooks, these packages include instructions for developers to use the require() function, a built-in feature for importing modules.
The attack sequence involves a downloader named WEL1DROPPER, which determines the host's operating system and processor architecture. It then fetches a suitable payload from one of three Cloudflare Workers hosts. If these HTTPS-based downloads fail, the malware resorts to DNS TXT records to retrieve the payload from a platform-specific domain known as wel1[.]ru.
In its final stage, the malware writes the payload to a temporary folder and executes it using shell commands on Linux and macOS, or cmd.exe on Windows. The campaign, tracked by Sonatype as Flooding Dropper, includes measures to evade detection and maintain persistence. On Windows, it patches Event Tracing and Antimalware Scan Interface, while on macOS, it sets up a LaunchAgent for persistence. The Linux variant is a UPX-packed ELF binary that ultimately deploys Sliver, a command-and-control framework.
The malicious packages also contain a file named telemetry.js, which mimics a telemetry SDK to disguise the downloader's logic. Some domains in the macOS payload suggest a focus on Russian financial institutions and mobile payments. This campaign is reminiscent of a previous attack in April, known as Moika, which similarly leveraged npm to deliver tailored payloads.
Additionally, researchers have observed threat actors exploiting Google Chrome extensions as part of this broader campaign. These extensions, marketed as various tools, covertly turn browsers into web crawling proxies by embedding a commercial web bandwidth-sharing SDK. This SDK connects the user's browser to a proxy network for web scraping, initiated through hidden iframes and Markdown conversions. Users are often prompted to opt into these services, with some extensions misleading users into believing that opting in is necessary for uninterrupted service.