Image courtesy by QUE.com
The Scale of the Attack
A massive campaign involving nearly 800 malicious packages has been discovered on the npm registry, delivering powerful cross-platform malware that targets Windows, macOS, and Linux systems alike. Security researchers have described the operation as one of the most significant software supply chain attacks of 2026, combining AI-generated package names with sophisticated delivery mechanisms to evade detection and infect developer machines worldwide.
According to OpenSourceMalware researcher Paul McCarty, the packages use "AI slop squatted, or randomly generated typo-squatting package names" to trick developers into installing them. Once loaded, every single package delivers a Remote Access Trojan (RAT) and infostealer payload capable of exfiltrating credentials, environment variables, and sensitive system data.
How the Infection Chain Works
Unlike typical npm supply chain attacks that rely on lifecycle hooks such as preinstall or postinstall to trigger malicious code execution, these packages take a different approach. Each package includes a README file that instructs developers to load the module using require(), the built-in Node.js function for importing modules and third-party packages.
When the package is loaded, it triggers a downloader component identified as WEL1DROPPER. This downloader performs the following steps:
- Identifies the host operating system and processor architecture
- Fetches a compatible payload from one of three Cloudflare Workers hosts
- If HTTPS downloads fail, falls back to DNS TXT records to retrieve next-stage payloads from the domain wel1.ru
- Writes the payload to a temporary folder and executes it using system shells
DNS TXT Record Delivery Mechanism
One of the most technically notable aspects of this campaign is its use of DNS TXT records as a payload delivery channel. The malware first requests a TXT record that specifies how many payload chunks to expect — a value between 1 and 2,000. It then retrieves numbered TXT records, joins the returned strings together, and Base64-decodes the result into a binary buffer.
This technique is particularly dangerous because DNS traffic is often allowed through firewalls and security appliances without inspection, making it an effective method for bypassing network-based defenses.
Platform-Specific Payloads
Windows
The Windows variant takes extensive steps to evade analysis and maintain persistence:
- Patches Event Tracing for Windows (ETW) to interfere with monitoring
- Patches the Antimalware Scan Interface (AMSI) to disable security scanning
- Checks for sandboxes and virtual machine environments
- Establishes persistence through Registry Run keys and scheduled tasks
- Downloads and executes an encrypted payload from a remote server
macOS
The macOS infection chain mirrors the Windows version but adapts to Apple's ecosystem. It scans for debuggers and analysis artifacts before retrieving a compatible payload. If the primary download fails, it employs the DNS TXT delivery method, sets up persistence using a LaunchAgent, and executes the binary as a detached process.
Linux
The Linux sample is a UPX-packed ELF binary configured to download auxiliary payloads from a Cloudflare Worker URL. Ultimately, it deploys Sliver, an open-source command-and-control (C2) framework that gives attackers full remote control over the compromised machine.
Deceptive Telemetry Disguises
Researchers also discovered that the packages contain a file called lib/telemetry.js that implements a plausible-looking telemetry SDK. However, hidden within this legitimate-appearing code is the same downloader logic used to fetch and execute malicious payloads.
The package's main entry point does not import this file, and it contains no additional hard-coded infrastructure. As OpenSourceMalware noted, the oversized telemetry implementation appears designed to add noise and make the malicious behavior look like native profiling or analytics functionality during a quick code review.
Potential Targets and Origins
The presence of domains such as tcsbank.ru and cloudpayments.ru in the macOS payload suggests the campaign may be targeting Russian financial institutions and mobile payment systems. Security analysts also suspect this is an evolution of a dependency confusion campaign codenamed Moika observed in April 2026, which saw over 250 packages published to npm to steal environment information and deliver OS-specific second-stage payloads.
Broader Context: Supply Chain Under Siege
This campaign is part of a wider trend of attacks targeting open-source package registries. Palo Alto Networks Unit 42 has documented multiple campaigns targeting both npm and the Python Package Index (PyPI) repository. In parallel, threat actors have been using Google Chrome extensions marketed as game emulators, password managers, and productivity tools to turn browsers into web crawling proxies via persistent WebSocket connections.
These combined efforts demonstrate that software supply chain attacks are no longer isolated incidents but a persistent and evolving threat category that demands proactive defense.
How Organizations Can Protect Themselves
Defending against supply chain malware requires a multi-layered approach:
- Use package scanning tools: Solutions like Socket, Sonatype, and Endor Labs can detect suspicious behavior in packages before installation
- Lock dependencies: Use lockfiles and pin exact versions to prevent unexpected package updates from introducing malicious code
- Review package metadata: Check author reputation, download counts, and repository links before adding new dependencies
- Monitor DNS traffic: Since this campaign uses DNS TXT records for payload delivery, DNS monitoring and filtering can help detect anomalous activity
- Implement least privilege: Run build and development environments with minimal permissions to limit the impact of compromised packages
- Enable runtime detection: Behavioral detection tools can identify suspicious process activity even when signature-based antivirus fails
The Road Ahead
The discovery of nearly 800 malicious npm packages underscores a sobering reality: the open-source ecosystems that modern software development depends on are under sustained attack. As threat actors increasingly leverage AI to generate convincing package names and camouflage malicious code within legitimate-looking functionality, the burden of defense falls on both maintainers and consumers of open-source software.
GitHub has begun implementing publish-time malware scanning for npm packages, but the sheer volume of submissions makes comprehensive detection an ongoing challenge. Organizations must assume that not every malicious package will be caught before it reaches a developer's machine, and build their security posture around that assumption.
The convergence of AI-generated content, DNS-based delivery mechanisms, and cross-platform targeting represents a new chapter in software supply chain warfare — one where vigilance, automation, and defense-in-depth are no longer optional but essential.
Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous
Articles published by QUE.COM Intelligence via Yehey.com website.
0 Comments