A massive supply chain attack involving a suspected Russian threat actor has compromised the npm registry within just 48 hours This article explores documented opensourcemalware wel1dropper. . The campaign, documented by opensourcemalware as WEL1DROPPER, is now spreading beyond 1,000 packages and represents an advanced form of "AI slopsquatting."

This technique uses randomly generated package names that trick developers into installing malware. The executable file is then dropped onto Linux/macOS as .cache_ and Windows as dotnet_diag_.exe, launched in the background with a fake "analytics" marker used solely for rate-limit switching for six hours. Analysis of the native binaries reveals that the Linux payload is UPX-packed and statically linked to an ELF format, while the macOS payload is a universal Mach-O binary capable of running on both Intel and Apple Silicon architectures.

The Linux binary’s final stage reportedly delivers what could be a Sliver implant—a popular open-source red-team C2 framework often used by real-world threat actors, although this remains unconfirmed. Paul McCarty attributes the campaign to a Russian actor with moderate confidence, citing the .ru domain and XOR-obfuscated strings referencing Russian financial institutions like tcsbank.ru and cloudpayments.ru, likely used as decoy health-check traffic. OSM link WEL1DROPPER connects to the earlier Moika campaign (250+ npm packages, April–May 2026), based on shared tradecraft including “oob”-infrastructure, fake telemetry camouflage, and similar kill-switch mechanisms.