Over 1,000 AI-named npm typosquats deliver a cross-platform dropper

OpenSourceMalware researcher Paul McCarty and Sonatype tracked a campaign they call Flooding Dropper, first counted at nearly 800 malicious npm packages and later revised to 1,033. The packages carry WEL1DROPPER, a cross-platform downloader that fetches operating-system-specific payloads: the open-source Sliver command-and-control framework on Linux, and encrypted payloads on Windows and macOS. Names are AI-generated typosquats rather than lifecycle-hook abuse, and execution depends on a developer calling require() on the package. Each publishing account uploaded only a handful of packages, which frustrates bulk takedown. macOS payloads referenced Russian financial domains. It follows the April 2026 Moika dependency-confusion campaign of 250-plus packages.

Why it matters

The interesting shift is operational, not technical. Generating plausible package names used to be the bottleneck in typosquatting, and an LLM removes it, so the registry now faces volume that manual moderation cannot match: 1,033 packages, spread thin across many accounts so no single ban clears the campaign. Defence has to move left of the registry. Use a private proxy registry with an allowlist rather than pulling straight from npm, require lockfiles and reproducible installs, block install-time network egress on build runners, and scan for name-similarity against your actual dependency list. Assume any developer or CI machine that installed one of these leaked its service account tokens, and rotate accordingly.

Source: The Hacker News