Published on gastropod.io on 08-14-2026

Nearly 800 npm Packages, AI-Generated Names, One Shared Backdoor: Inside WEL1DROPPER

Tags: vulnerability-intelligence, software-supply-chain-security, npm, malware, credential-theft, typosquatting

Researchers are tracking an npm campaign that has published more than 700 malicious packages since early August, with confirmed counts passing 1,000 already (8/14/2026). The packages carry no recognizable brand names to typosquat and no shared theme. Each one is a plausible-sounding, machine-generated string that exists for exactly one purpose: get installed, then run a downloader researchers call WEL1DROPPER.

The packages skip the usual postinstall script that most malicious-package scanners watch for. Instead, the payload runs when a developer's code calls require() on the package, a detection gap most tooling built around install-time hooks doesn't cover. Once it runs, WEL1DROPPER fingerprints the host operating system and CPU architecture and fetches a matching second-stage payload through one of two channels: HTTPS requests to a rotating set of Cloudflare Workers hostnames or, if that's blocked, base64-encoded payload chunks pulled from DNS TXT records under wel1.ru. The second stage differs by platform: an encrypted Windows executable that patches ETW and AMSI to blind local security tooling, a macOS beacon that installs itself as a LaunchAgent for persistence, and a UPX-packed Linux binary that deploys the Sliver command-and-control framework (The Hacker News).

The evidence points to Russian operators. The wel1.ru infrastructure, code references to Russian financial institutions including TCSBank and CloudPayments, and shared tradecraft with an earlier campaign called Moika, which published over 250 npm packages in April and May using the same "oob" naming pattern in files and server names, all point the same direction (OpenSourceMalware). Whether the campaign is aimed at those institutions directly or is laundering credentials through them isn't yet public.

The naming strategy is what sets this apart from a typical npm compromise. Most malicious-package campaigns typosquat a specific popular library, banking on a developer's typing mistake or a confused AI coding assistant pulling in a name that looks close enough. WEL1DROPPER doesn't bother imitating anything. It floods the registry with hundreds of unique, forgettable names at once, on the assumption that no automated scanner or human reviewer can flag that many brand-new, zero-download packages fast enough to matter before some of them get pulled into a real build. Researchers at gbhackers and SC Media both frame this as a step past typosquatting: name recognition stops mattering once volume does the work instead.

The recommended response is broader than a version upgrade. Security teams are being told to check lockfiles, build caches, and CI logs for any of the confirmed package names, review DNS logs for lookups to wel1.ru, and treat any confirmed execution as a host compromise requiring credential rotation across npm tokens, GitHub tokens, cloud credentials, and signing keys, not just a package removal.

A campaign built on volume and disposable names is exactly the case where package-level history matters more than package-level reputation. A single new, single-purpose package from a brand-new publisher account isn't unusual on its own; hundreds of them published within the same short window, all with the same install-then-require() pattern, is. Gastropod treats every npm artifact as a tracked record, including publisher account age, publication timing, and version history, rather than scoring packages in isolation. That's the same layer that flags identity mismatches and namespace confusion at intake before a dependency spreads through a build. The product page has more on how that intake scrutiny works across the ecosystems we support.

Sources: