Loading story…
Sonatype Research Labs reported an active software supply-chain campaign, dubbed Flooding Dropper, that pushed roughly 850 malicious npm packages through disposable publisher accounts and patterned package names and versions. The packages act as first-stage JavaScript loaders that fetch and execute platform-specific second-stage payloads for Windows, Linux, and macOS, using both HTTPS downloads and DNS TXT record fallback to maintain delivery if primary infrastructure is blocked.
The activity aligns with CWE-506: Embedded Malicious Code, a weakness category covering intentionally harmful functionality such as trojans, trapdoors, and spyware embedded in distributed software. Sonatype said the Windows payload uses defense evasion and persistence techniques including patching ETW and AMSI, checking for analysis environments, creating Registry Run keys and scheduled tasks, and reflectively loading an encrypted payload in memory; defenders are advised to treat any system that installed an affected package as compromised, investigate persistence and follow-on payload execution, and rotate exposed credentials only after remediation is complete.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
OpenSourceMalware reported the malicious npm package bigops-backend, which delivered a platform-specific binary to Windows, Linux, and macOS systems.
Researchers detailed the Flooding Dropper npm campaign as using hundreds of malicious packages that trick developers into executing them via README instructions, triggering the WEL1DROPPER downloader to fetch platform-specific malware. The disclosure described Cloudflare Workers and DNS TXT-based delivery, Windows ETW/AMSI tampering and persistence, macOS LaunchAgent persistence, and Linux deployment of Sliver.
MITRE published CWE-506, defining a software weakness in which a product contains code that appears malicious in nature, such as Trojan horses, trapdoors, logic bombs, or spyware.
Sonatype Research Labs assessed bigops-backend as part of a larger active npm supply-chain campaign it tracks as Flooding Dropper, with 846 implicated software components at the time of reporting.
MITRE's CWE Content Team updated the CWE-506 entry as part of CWE 4.15, reflecting maintenance of the weakness definition and related taxonomy content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 44 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
8 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcetrojan-killer.net
Open sourcecyberveille.ch
Open sourcethehackernews.com
Open sourceopensourcemalware.com
Open sourcemalware.news
Open sourcesonatype.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Sonatype report identified six malicious **npm** packages that used **Ethereum transactions** to retrieve and stage malicious payloads, an unusual delivery method that obscures second-stage infrastructure behind blockchain activity. The campaign was linked in public reporting to **ContagiousInterview** and **NullReceiver**, indicating continued abuse of the JavaScript and Node.js ecosystem for software supply-chain compromise. The activity aligns with broader attacker tradecraft documented for **MITRE ATT&CK `T1059.007`** (**Command and Scripting Interpreter: JavaScript**), which covers JavaScript and Node.js use for payload delivery, execution, reconnaissance, and command-and-control. Defenders monitoring follow-on behavior should watch for suspicious child-process activity and discovery commands launched from non-shell parent processes, a pattern reflected in Splunk detection guidance for tools such as `ipconfig.exe`, `systeminfo.exe`, `net.exe`, and `whoami.exe` executed outside normal `cmd.exe` or PowerShell chains.
Aug 12, 2026
Researchers linked a threat actor tracked as **RED-LILI** to a large-scale software supply chain attack that pushed nearly **800 malicious packages** to the **npm** registry in a burst of activity over roughly a week. Checkmarx reported the operation began around February 23, 2022, and relied on a highly automated pipeline that created a separate npm account for each package, complicating bulk detection and takedown efforts. The campaign used custom Python tooling, Selenium, and the open-source **Interactsh** project to automate account creation and bypass npm email one-time-password verification during signup. The malicious packages were part of a broader effort to compromise developers and downstream environments through common package ecosystem abuse techniques, including **typosquatting** and **dependency confusion**. Reporting tied the activity to packages crafted to target organizations such as **Azure, Uber, and Airbnb**, underscoring how attackers can industrialize package publication at scale and turn open-source repositories into an efficient delivery channel for supply chain compromise.
Aug 15, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026