Over 800 Malicious npm Packages Pose Cross-Platform Threat
New malware campaign targets Windows, Mac, and Linux systems through npm registry.
1Campaign Scope
Researchers have identified nearly 800 malicious packages uploaded to the npm registry. These packages use randomly generated typo-squatted names but all deliver a powerful Remote Access Tool (RAT) and information stealer payload. The packages contain README files that instruct developers to load them using the require() function, a less suspicious method compared to traditional lifecycle hooks.
2Downloader and Distribution Mechanism
The malicious packages execute a downloader called WEL1DROPPER, which identifies the host's OS and processor architecture before fetching a compatible payload from one of three Cloudflare Workers hosts. If HTTPS-based downloads fail, the malware switches to a platform-specific domain and uses DNS TXT records to obtain the next-stage payload. This technique is designed to bypass traditional defense mechanisms.
3Windows Execution and Persistence
On Windows systems, the payload is written to a temporary folder and executed via cmd.exe. The malware patches Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) to evade monitoring. It detects sandboxes and virtual environments, establishes persistence through a Registry Run key and scheduled task, then downloads and runs an encrypted payload. This multi-stage approach demonstrates sophisticated evasion techniques.
4macOS and Linux Variants
The macOS infection chain performs similar actions, checking for debuggers before retrieving a compatible payload. If unsuccessful, it employs DNS TXT delivery and sets up persistence via LaunchAgent. Linux samples contain UPX-packed ELF binaries configured to download additional payloads from Cloudflare Worker URLs, ultimately deploying Sliver, an open-source C2 framework. This cross-platform compatibility makes the threat particularly dangerous.
5Telemetry SDK Camouflage
Packages include a file named 'lib/telemetry.js' that implements a plausible-looking telemetry SDK while containing the same downloader logic. The package entry point doesn't import this file, which contains no hard-coded infrastructure. The oversized telemetry implementation appears designed to make malicious behavior resemble native profiling functionality during cursory reviews, showcasing advanced obfuscation techniques.
6Targets and Origins
Domains like 'tcsbank[.]ru' in macOS payloads suggest Russian financial institutions may be targets. The campaign is suspected to be an evolution of April's 'Moika' dependency confusion attack that published 250+ npm packages to steal environment data. This connection indicates ongoing refinement of software supply chain attacks by likely Eastern European threat actors specializing in financial cybercrime.
7Related Chrome Extension Threats
Palo Alto Networks Unit 42 documented additional campaigns targeting npm and PyPI repositories. They observed Chrome extensions marketed as productivity tools secretly turning browsers into web crawling proxies. These extensions embed a commercial bandwidth-sharing SDK that connects to third-party proxy networks, crawling pages via hidden iframes and converting content to Markdown for exfiltration - all while disclosing these practices in privacy policies.
8Security Implications
The proliferation of such malicious packages underscores critical software supply chain vulnerabilities. Developers must exercise extreme caution with third-party dependencies, verifying their origins. Enterprises should reassess open-source risk management strategies and adopt AI-enhanced security solutions. These threats represent an evolving challenge to software ecosystem trust, requiring continuous vigilance and multilayered defense approaches across development pipelines.