Malware

WEL1DROPPER

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload.

Execution

3 techniques

T1053Scheduled Task/JobEvidence1

establish persistence through a Registry Run key and a scheduled task

T1059Command and Scripting InterpreterEvidence1

In the final stage, the payload is written to a temporary folder and executed either using "/bin/sh" on Linux and macOS, or "cmd.exe" on Windows.

T1204User ExecutionEvidence1

the newly identified packages come with a README that instructs developers to load them with require(), a built-in function to import modules, local files, and third-party packages.

Persistence

3 techniques

T1053Scheduled Task/JobEvidence1

establish persistence through a Registry Run key and a scheduled task

T1543.001Launch AgentEvidence1

sets up persistence using a LaunchAgent

T1547.001Registry Run Keys / Startup FolderEvidence1

establish persistence through a Registry Run key

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

establish persistence through a Registry Run key and a scheduled task

T1543.001Launch AgentEvidence1

sets up persistence using a LaunchAgent

T1547.001Registry Run Keys / Startup FolderEvidence1

establish persistence through a Registry Run key

Stealth

3 techniques

T1036MasqueradingEvidence1

The packages have also been found to contain a file called "lib/telemetry.js" that implements a plausible-looking telemetry SDK but also contains the same downloader logic.

T1497Virtualization/Sandbox EvasionEvidence1

check for sandboxes and virtual environments

T1622Debugger EvasionEvidence1

performing an identical set of actions to look for debuggers and analysis artifacts

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

check for sandboxes and virtual environments

T1622Debugger EvasionEvidence1

performing an identical set of actions to look for debuggers and analysis artifacts

Command and Control

3 techniques

T1071.004DNSEvidence1

The package first requests a TXT record from c.<domain> ... It then requests numbered TXT records. The returned strings are joined together and Base64-decoded into a binary buffer.

T1105Ingress Tool TransferEvidence1

WEL1DROPPER ... identifies the host operating system and processor architecture and fetches a compatible payload from one of the three Cloudflare Workers hosts.

T1568Dynamic ResolutionEvidence1

If the HTTPS-based downloads fail, the malware switches to a platform-specific domain and uses DNS TXT records to obtain the next-stage from the domain "wel1[.]ru."

Other

1 technique

T1562Impair DefensesEvidence1

the Windows version taking steps to patch Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) to interfere with monitoring

INDICATORS OF COMPROMISE

IOCs tracked for this family

44 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

20 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

17 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Aug 7, 2026

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cross-platform downloader used in malicious npm packages. It fingerprints the victim OS and architecture, retrieves staged payloads over HTTPS or via DNS TXT fallback, writes them to a temporary folder, and executes them. The Windows path includes ETW and AMSI patching, sandbox/VM checks, persistence via Registry Run key and scheduled task, and retrieval of an encrypted payload; macOS uses similar anti-analysis behavior and LaunchAgent persistence.

opensourcemalware blogNews

Aug 6, 2026

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages | OpenSource Malware Blog

A cross-platform npm-delivered downloader/dropper campaign that executes on package import, retrieves native payloads over HTTPS from Cloudflare Workers or reconstructs them from DNS TXT records under wel1.ru, then silently executes them. The payload chain includes RAT/infostealer functionality, with the macOS stage adding anti-analysis, persistence via LaunchAgent, and retrieval of an additional beacon.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching44

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

WEL1DROPPER

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload.

Execution

3 techniques

T1053Scheduled Task/JobEvidence1

establish persistence through a Registry Run key and a scheduled task

T1059Command and Scripting InterpreterEvidence1

In the final stage, the payload is written to a temporary folder and executed either using "/bin/sh" on Linux and macOS, or "cmd.exe" on Windows.

T1204User ExecutionEvidence1

the newly identified packages come with a README that instructs developers to load them with require(), a built-in function to import modules, local files, and third-party packages.

Persistence

3 techniques

T1053Scheduled Task/JobEvidence1

establish persistence through a Registry Run key and a scheduled task

T1543.001Launch AgentEvidence1

sets up persistence using a LaunchAgent

T1547.001Registry Run Keys / Startup FolderEvidence1

establish persistence through a Registry Run key

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

establish persistence through a Registry Run key and a scheduled task

T1543.001Launch AgentEvidence1

sets up persistence using a LaunchAgent

T1547.001Registry Run Keys / Startup FolderEvidence1

establish persistence through a Registry Run key

Stealth

3 techniques

T1036MasqueradingEvidence1

The packages have also been found to contain a file called "lib/telemetry.js" that implements a plausible-looking telemetry SDK but also contains the same downloader logic.

T1497Virtualization/Sandbox EvasionEvidence1

check for sandboxes and virtual environments

T1622Debugger EvasionEvidence1

performing an identical set of actions to look for debuggers and analysis artifacts

Discovery

2 techniques

T1497Virtualization/Sandbox EvasionEvidence1

check for sandboxes and virtual environments

T1622Debugger EvasionEvidence1

performing an identical set of actions to look for debuggers and analysis artifacts

Command and Control

3 techniques

T1071.004DNSEvidence1

The package first requests a TXT record from c.<domain> ... It then requests numbered TXT records. The returned strings are joined together and Base64-decoded into a binary buffer.

T1105Ingress Tool TransferEvidence1

WEL1DROPPER ... identifies the host operating system and processor architecture and fetches a compatible payload from one of the three Cloudflare Workers hosts.

T1568Dynamic ResolutionEvidence1

If the HTTPS-based downloads fail, the malware switches to a platform-specific domain and uses DNS TXT records to obtain the next-stage from the domain "wel1[.]ru."

Other

1 technique

T1562Impair DefensesEvidence1

the Windows version taking steps to patch Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) to interfere with monitoring

INDICATORS OF COMPROMISE

IOCs tracked for this family

44 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

20 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

17 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Aug 7, 2026

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

opensourcemalware blogNews

Aug 6, 2026

Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages | OpenSource Malware Blog

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching44

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.