A Silent Threat: How Hackers Used AI to Plant 800 Malicious Packages in npm

In a critical escalation threatening the core of software supply chains, cybersecurity experts have uncovered a fierce campaign simultaneously targeting Windows, Mac, and Linux systems. The danger is no longer arriving via phishing emails; it is lurking inside the code libraries developers trust every single day.

The AI Trap: A New "Stealth" Tactic

Attackers have flooded the npm registry with nearly 800 malicious packages. What makes this terrifying is their use of Artificial Intelligence to generate highly deceptive typo-squatting package names to trick developers. Unlike traditional attacks that rely on lifecycle hooks (like preinstall or postinstall scripts), this campaign relies purely on social engineering. The README file instructs the developer to manually load the package using the built-in require() function, expertly evading automated malware scanners.

The "WEL1DROPPER" Virus: A Cross-Platform Demon

Once the package is invoked, it triggers a malicious downloader named WEL1DROPPER. This program intelligently identifies the host's operating system and processor architecture, then fetches its destructive payload (a powerful RAT and Infostealer) via Cloudflare Workers servers.

What if the direct HTTPS connection fails? Here lies the hackers' cunning. The virus shifts to using DNS TXT records to pull next-stage commands from Russian domains like wel1[.]ru. It parses the strings, concatenates them, and Base64-decodes them into a final executable binary buffer.

Camouflage Techniques and OS-Specific Control

• Windows: The virus actively disables Antimalware Scan Interfaces (AMSI) and Event Tracing for Windows (ETW), then establishes persistence by planting itself in Registry Run keys.
• macOS: The malware executes rigorous checks for debuggers and analysis artifacts before securing persistence via a LaunchAgent.
• Linux: The system deploys an UPX-packed ELF binary that ultimately installs Sliver, an open-source command-and-control (C2) framework.

To increase obfuscation, these packages contain a fake file named telemetry.js. It looks exactly like a benign performance-tracking SDK but serves as a cover to hide malicious downloading behavior during quick human reviews. Similar attacks targeting PyPI repositories to steal cryptocurrency wallets and environment secrets (.env) have also been documented.

The Threat Expands: Chrome Extensions Turned Spies

Hackers did not stop at code repositories; the attacks have extended to your web browser. Recent security reports highlight the use of seemingly innocent Chrome Extensions—such as password managers and game emulators—to turn the user's browser into a secret proxy for web scraping operations. This is achieved by injecting hidden iframes and receiving remote commands via a persistent WebSocket connection to exfiltrate background data.