The npm Attack That Waits for Your First Import is called WEL1DROPPER. 1000+ Components. Packages ship no `preinstall` or `postinstall` script. README files tell the developer to load the module with `require()`, and that one call starts the chain. Protect your repos and environments…

More than a thousand malicious packages reached the npm registry this month with no lifecycle hooks. Researchers now count 1,033 confirmed components in the campaign, tracked as WEL1DROPPER by OpenSourceMalware and as Flooding Dropper by Sonatype Research Labs. The operation walked past the defense most organizations spent the past year building.

The packages ship no preinstall or postinstall script. Their README files tell the developer to load the module with require(), and that one call starts the chain. A bundled helper begins executing the moment application code, a test suite, a local CLI, or a CI job touches the module. Teams that disabled install scripts, wrote a narrow allowlist, and enabled package-release cooldowns bought real protection against a different attack.

The delivery chain

The downloader fingerprints the host operating system and CPU architecture, then pulls a matching native payload from one of three Cloudflare Workers hosts. Failure of the HTTPS path triggers a fallback that deserves attention from platform teams. The malware queries a TXT record at c.<domain> under wel1[.]ru, reads the response as a chunk count between 1 and 2,000, requests that many numbered TXT records, joins the returned strings, and Base64-decodes the result into a binary buffer. Build networks that enforce egress proxies, URL filtering, and TLS inspection frequently treat DNS as plumbing. This campaign turns name resolution into a delivery channel.

Second-stage behavior is tailored to the host. The Windows sample patches ETW and AMSI, checks for sandboxes and virtual machines, plants a Registry Run key and a scheduled task, then executes an encrypted payload in memory. macOS gets a LaunchAgent and a beacon binary. Linux receives a UPX-packed ELF that terminates in Sliver, an open source command-and-control framework.

Every package also carries a lib/telemetry.js file, an oversized fake analytics SDK holding a second copy of the downloader. The entry point never imports it. Its job is to absorb attention during a fast source review.

Names manufactured on demand

The naming strategy is the other half of the story. These identifiers are randomly generated or AI-slopsquatted, shaped to resemble what a coding assistant might hallucinate when a developer asks for a mobile payments or checkout SDK. Classic typosquatting rides on proximity to a real dependency. Slopsquatting runs the other direction: an assistant invents a plausible name, a developer goes looking for it, and an attacker registers it first. Package age and download counts have nothing useful to say about a name that is three days old and freshly recommended. Publisher accounts are disposable, a few packages each, which spreads registry moderation across hundreds of identities.

What to change

• Admission control on new dependencies. Route any assistant-suggested name through an internal registry or an approved catalog before it enters a manifest. First-publication date, publisher history, repository provenance, and independent adoption are the fields worth reading.
• Scan for import-time behavior. Entry points, export maps, and transitive modules need inspection for child-process spawning, outbound network calls, temporary-file writes, and dynamic evaluation.
• Instrument DNS from build systems. Sequential subdomain queries, high-volume TXT lookups, anomalous response sizes, and Base64-shaped record content are all visible in resolver logs from package managers and ephemeral CI runners.
• Assume host compromise after exposure. Isolate the machine, hunt for persistence and secondary payload execution, remediate, then rotate credentials once the environment is clean.

Install-script hardening keeps its place in the toolchain. This campaign clarifies where the rest of the perimeter belongs: at the moment code loads, and at the resolver.

This is a really good use-case for implementing Tidra.ai to review your repositories, look for issues like WEL1DROPPER and mitigate them before the issues become an incident or security concern. This is especially useful if you have a large number of repositories. The perimeter is changing and we all need to adapt quickly as the landscape evolves.

Article Sources for additional info

1. McCarty, Paul (6mile). "Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages." OpenSourceMalware, August 6, 2026.
2. Lakshmanan, Ravie. "Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer." The Hacker News, August 7, 2026; updated August 11, 2026 with the 1,033-package figure attributed to OpenSourceMalware co-founder Jenn Gile.
3. Sonatype Research Labs (research by Jorge Cardona). "'Flooding Dropper' Campaign Hits npm With Nearly 850 Malicious Packages." Sonatype Blog, August 2026. Campaign identifier sonatype-2026-005660.
4. "'Flooding Dropper' Is Hitting npm With a Tidal Wave of Malicious Packages." DevOps.com, August 7, 2026.
5. "Nearly 800 Malicious npm Packages Deliver Cross-Platform Malware." SC Media (SC World), brief, August 2026.
6. Unit 42, Palo Alto Networks. "Obfuscated JavaScript Crypto Stealer in npm Packages." Unit 42 Timely Threat Intelligence, August 6, 2026.
7. Cloud Security Alliance Research Labs. "Slopsquatted npm Packages Deliver RAT and Infostealer." CSA Research Note, 2026.
8. Socket Research Team. "Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages." Socket Blog, 2026.
9. Truesec. "500+ npm Packages Compromised in Ongoing Supply Chain Attack: Shai-Hulud." Truesec Threat Intelligence, 2026.