Researchers found nearly 800 malicious npm packages that trick developers into installing them through typo-squatted package names and believable documentation. Instead of auto-running on install, the packages rely on the developer following README instructions to load the module, which then downloads and runs a cross-platform remote access trojan (RAT) and infostealer.
Researchers identified nearly 800 malicious npm packages using typo-squatted or randomly generated names designed to look like legitimate dependencies. Rather than triggering malicious behavior automatically during install, these packages rely on a social engineering step: the README file instructs developers to load the module using require(), a common built-in function for importing modules and third-party packages. That single, seemingly routine action starts the infection chain.
Once required, the package runs a downloader named WEL1DROPPER, which fetches a payload matched to the victim's operating system and CPU architecture. The downloader first tries three Cloudflare Workers hosts over HTTPS. If those fail, it falls back to a platform-specific domain and retrieves the next stage using DNS TXT records, a technique that helps the malware blend into normal-looking network traffic.
On Windows systems, the described payload behavior includes patching ETW and AMSI to reduce detection, running sandbox checks, and establishing persistence through a Registry Run key and a scheduled task before downloading an encrypted payload.
This campaign succeeds by exploiting developer trust in documentation rather than exploiting a technical vulnerability in npm itself. Developers routinely follow README instructions without a second thought, and instructing them to require() a module is an ordinary, expected action. Some packages also included a telemetry-style SDK file designed to look like legitimate analytics, which can help malicious code pass a casual code review. The combination of a believable lure, a familiar workflow step, and infrastructure that fails over between HTTPS and DNS TXT records makes the chain harder to catch at any single point.
Teams can reduce exposure by treating any new or unfamiliar dependency as a potential social engineering vector, not just a code quality question. Verify package names, maintainers, and version history before adopting a dependency, and be skeptical of documentation that asks you to run or import code as a first step. Extend this awareness beyond npm to browser extensions: train users to question opt-in prompts for proxy or bandwidth-sharing features, particularly when the messaging suggests the tool won't work otherwise. Building this instinct across developers, DevOps, and general employees closes a gap that technical scanning alone won't fully cover.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The packages do not auto-execute on install. Instead, their README instructs developers to load the module using require(), and that step triggers a downloader called WEL1DROPPER that fetches an OS/CPU-specific payload.
It first tries to fetch a payload from Cloudflare Workers hosts over HTTPS, and if that fails it falls back to a platform-specific domain and uses DNS TXT records to retrieve the next stage.
Some packages include a plausible-looking telemetry SDK file, which can make malicious network activity appear to be legitimate analytics code during review.
No, the reporting also describes Chrome extensions that prompt users to opt in to a proxy or crawling SDK, sometimes framing the opt-in as required for the tool to keep working.
You install a tiny npm helper, follow the README require() example… and you just ran a RAT on your laptop. Researchers just found nearly 800 typo-squatted npm packages like this. They look legit, with README docs telling you to load them with require(). But once you do, WEL1DROPPER quietly pulls a RAT and infostealer from Cloudflare Workers or even DNS TXT records at wel1.ru. The Windows payload patches ETW and AMSI, hides in a Registry Run key and a scheduled task, and can hide behind a noisy lib/telemetry.js file that looks like analytics. Same playbook shows up in Chrome extensions like InstaSkip, nudging you to ‘opt in’ to a proxy SDK for “uninterrupted service.” Here’s the move: before you copy any README require() line, pause and check the package name, owner, and download history. If the name looks like a typo, random, or brand new, don’t import it, stop and report it.
Researchers showed that a single public GitHub issue (from someone with no repo access) could steer popular AI coding agents into running dangerous commands, exposing tokens, and changing repositories. The risk comes from AI agents reading untrusted issue/PR text while also having access to…
Attackers compromised the @asyncapi npm organization by abusing a misconfigured GitHub Actions workflow, then republished multiple AsyncAPI-related packages with a hidden loader. The malware ran automatically when the poisoned packages were imported (not during install), pulled a second-stage…
Cisco Talos reports a remote access trojan (msaRAT) linked to the Chaos ransomware group that hides its command-and-control traffic inside legitimate Chrome/Edge browser activity. The malware is delivered as a fake “Windows update” MSI and, once run, launches a browser in a special debug mode to…
Federal investigators arrested a Florida man accused of helping push malware disguised as video games, which infected about 8,000 devices and enabled theft from cryptocurrency wallets. The games were promoted through social platforms and direct messages aimed at people believed to hold significant…
Cybercriminals sent emails styled like Bank of America that redirected victims to fake pages and pushed a download called “Account Guard.” On Windows, the download installed ScreenConnect remote management software, giving attackers remote control of the device. The campaign used lookalike domains…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
