WEL1DROPPER Floods npm With More Than 700 Malicious Packages
OpenSourceMalware researchers disclosed a cross-platform npm campaign that published more than 700 malicious packages in 48 hours and had reached 788 tracked packages when the report was retrieved. Importing an affected package can trigger a native downloader that uses Cloudflare Workers or DNS TXT records to deliver payloads, so blocking npm install scripts alone does not stop the infection path.
OpenSourceMalware disclosed the WEL1DROPPER campaign on August 6, 2026, after observing more than 700 malicious npm packages published over 48 hours. The originating report said the researchers were tracking 788 packages when it was retrieved; later GBHackers coverage said the count continued to rise.
The import starts the infection chain
The packages pose as mobile software-development kits with plausible names and lightweight APIs. In the example analyzed by OpenSourceMalware, importing checkout-mobile-bnpl loads a helper file that immediately runs the downloader. That matters because the package does not need an npm preinstall or postinstall hook. Lifecycle-script restrictions can reduce risk, but they do not prevent malicious dependency code from executing when an application imports it.
The downloader identifies the operating system and processor architecture, then requests a native payload for Windows, Linux, or macOS from one of three Cloudflare Workers hosts. If those HTTPS requests fail, it queries platform-specific subdomains under wel1.ru, joins Base64-encoded chunks returned through DNS TXT records, and writes the reconstructed executable to a temporary path. The process then launches in the background under filenames designed to resemble cache or diagnostic files.
Native stages add persistence and evasion
OpenSourceMalware analyzed Linux and macOS binaries served by the campaign. Its macOS sample checked for debuggers, instrumentation tools, VMware artifacts, and system memory before creating a disguised LaunchAgent for persistence and attempting another payload download. The researchers had not confirmed the final beacon's full behavior, so claims about the last stage remain provisional.
The report links the campaign tentatively to a Russian nexus because of the wel1.ru delivery domain, embedded Russian financial-domain strings, and tradecraft shared with the earlier Moika package campaign. Those indicators support investigation, not definitive attribution; the originating analysis says the relationship is possible rather than proven.
What defenders should verify
Teams should compare lockfiles, software bills of materials, package-manager caches, build logs, and deployed applications with the maintained package list. A match should prompt checks for actual imports, the reported DNS TXT patterns, Cloudflare Workers traffic, temporary executable names, and the macOS LaunchAgent. If execution is confirmed, credentials accessible to the affected developer workstation or CI runner may also require rotation and the host should be handled as a potential compromise.
Key Points
- 1OpenSourceMalware observed more than 700 malicious npm packages in 48 hours and was tracking 788 packages when its August 6 report was retrieved.
- 2Affected packages can execute a cross-platform downloader when imported, then use Cloudflare Workers or DNS TXT records to deliver native payloads without npm lifecycle scripts.
- 3The evidence suggests but does not prove a Russian nexus; defenders should prioritize package, DNS, process, and persistence indicators over definitive attribution.
Scoring Rationale
The campaign combines high-volume package publication, cross-platform native malware, DNS-based fallback delivery, and import-triggered execution that can bypass lifecycle-script controls. It presents a material developer and CI supply-chain risk, while final-stage behavior and actor attribution remain partly unresolved.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
