[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fO02iV0wOTx88OtrXys8fN_m5TC7n2lF8g2N3UeP6Fac":3},{"article":4,"iocs":54,"watch_terms":88,"solutions":89,"lesson":179},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"4dbb86ca-666d-4c7b-bf79-3c0989d4fc24","Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer","nearly-800-malicious-npm-packages-deliver-cross-platform-rat-and-infostealer-7f2f00","A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. \"These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload,\" OpenSourceMalware researcher Paul","A campaign involving nearly 800 malicious npm packages has been discovered, targeting Windows, Mac, and Linux systems with a cross-platform RAT and infostealer. These packages, using AI-generated or typo-squatted names, instruct developers to load them via require(), leading to the execution of a downloader that fetches compatible payloads from Cloudflare Workers or uses DNS TXT records for delivery. The final payloads aim to evade detection, establish persistence, and deploy tools like Sliver on Linux.","Nearly 800 malicious npm packages deliver cross-platform RAT and infostealer.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fnearly-800-malicious-npm-packages.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiIEXaa59LRblZ0rcBVbKDdH4w9Rszk27anNt20Onx7Li8D7FXbf3Ipod53uo3N2aa6Hj1QLJaNFDIBlrcgM3YZg0UJCsjI3maDKkFEdOeyhzis15St3QDg6WCXcYlbDRlw2WvgiOH-BL_v8I21QoSTE9kmJzzKqQwstqn11JWkAL1_9W41ZF04T-9ImaiL\u002Fs1600\u002Fnpms.jpg","2026-08-07T18:48:17+00:00","2026-08-07T20:00:21.582593+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"npm","technology",{"name":21,"type":19},"Cloudflare Workers",{"name":23,"type":19},"DNS TXT records",{"name":25,"type":19},"ETW",{"name":27,"type":19},"AMSI",{"name":29,"type":30},"Sliver","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,61,63,66,69,72,75,78,81,83,86],{"type":56,"value":57,"context":58},"domain","oob-worker.cf103-070.workers.dev","Cloudflare Workers domain for initial payload download",{"type":56,"value":60,"context":58},"oob-worker.cf102-baf.workers.dev",{"type":56,"value":62,"context":58},"oob-worker.cf99-9b3.workers.dev",{"type":56,"value":64,"context":65},"wel1.ru","Fallback domain for next-stage payload delivery via DNS TXT records",{"type":56,"value":67,"context":68},"sdk.dl.wel1.ru","Linux x64 payload delivery domain",{"type":56,"value":70,"context":71},"ext.dl.wel1.ru","Linux ARM64 payload delivery domain",{"type":56,"value":73,"context":74},"pkg.dl.wel1.ru","macOS payload delivery domain",{"type":56,"value":76,"context":77},"net.dl.wel1.ru","Windows payload delivery domain",{"type":56,"value":79,"context":80},"tcsbank.ru","Potential target domain found in macOS payload",{"type":56,"value":82,"context":80},"cloudpayments.ru",{"type":35,"value":84,"context":85},"WEL1DROPPER","Name of the initial downloader malware",{"type":35,"value":29,"context":87},"Open-source C2 framework deployed on Linux",[29],{"controls":90,"vendors":172},[91,120,145],{"slug":92,"name":93,"problem":94,"products":95},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":121,"name":122,"problem":123,"products":124},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[125,131,138],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":126,"product_name":127,"url":129,"description":130},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":135,"url":136,"description":137},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":121,"product_name":142,"url":143,"description":144},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"slug":146,"name":147,"problem":148,"products":149},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[150,158,164],{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":159,"vendor_name":160,"vendor_logo":161,"product_slug":159,"product_name":160,"url":162,"description":163},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":165,"vendor_name":166,"vendor_logo":167,"product_slug":168,"product_name":169,"url":170,"description":171},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[173],{"slug":174,"name":175,"logo_path":176,"roles":177},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png",[178],"reported_by",{"slug":180,"title":181,"body":182,"framework_refs":183,"framework_notes":193},"800-malicious-npm-packages-weaponize-developer-pipelines-with-rat-and-infostealer","800 Malicious npm Packages Weaponize Developer Pipelines with RAT and Infostealer","Attackers published nearly 800 malicious npm packages using typosquatting and AI-generated names to trick developers into installing them via routine require() calls, effectively turning the software supply chain into a malware delivery mechanism. Once loaded, the packages fetch cross-platform payloads capable of establishing persistence and deploying remote access tools like Sliver across Windows, Mac, and Linux. This attack exploits the inherent trust developers place in public package registries and the speed at which dependencies are pulled into projects without sufficient vetting. The use of Cloudflare Workers and DNS TXT records for payload delivery demonstrates sophisticated evasion designed to bypass traditional network controls. This matters because a single compromised developer machine can cascade into a full organizational breach or even poison downstream software releases.",[184,185,186,187,188,189,190,191,192],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SSDF (SP 800-218) PW.4: Reuse Well-Secured Software","OWASP A06:2021 – Vulnerable and Outdated Components","SLSA Supply Chain Security Framework: Source and Build Integrity","GDPR Article 32: Security of Processing (for orgs handling EU data)",{}]