Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

Summary: Nearly 800 malicious packages were published to the npm registry in a campaign that delivers a cross-platform RAT and infostealer to Windows, Mac, and Linux, using AI slop squatted or randomly generated typo-squatting names and a README that tells developers to load them with require(). The packages execute a downloader named WEL1DROPPER that identifies the host OS and architecture, fetches a payload from one of three Cloudflare Workers hosts, and falls back to DNS TXT records from wel1[.]ru if HTTPS downloads fail.
Bottom line: OpenSourceMalware co-founder Jenn Gile put the confirmed package count at 1,033, and Sonatype notes the actors use randomly generated account names publishing only a handful of packages each - so removing one prolific publisher will not eliminate the operation, and each account and package may need to be identified, reviewed, and removed independently.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026