Poisoned Pipeline / Incidents / AS43
WEL1DROPPER / NUL1DROPPER npm slopsquatting
In 48 hours a threat actor published 700+ npm packages with AI-slop /
random typosquat names (OpenSourceMalware: WEL1DROPPER, also Flooding
Dropper / NUL1DROPPER). No preinstall/postinstall. The README tells
developers to require() the library; that import loads _helpers.js and
starts a cross-platform RAT/infostealer. Primary C2 is three Cloudflare
Workers; fallback reconstructs the payload from DNS TXT under wel1.ru.
Example package checkout-mobile-bnpl@35.6.9.
Mapped techniques
- T0129 Typosquatting
- T0109 Publish malicious artifact
- T0159 Malicious artifact execution
- T0110 Advertise malicious artifact
supply-chain npm slopsquats
Hundreds of AI-generated / random lookalike names.
700+ packages in two days.
require() is enough; no install scripts, so npm v12 script blocks miss it.
README instructs developers to load the fake SDK.