This campaign involves a threat actor publishing over 700 malicious NPM packages using AI-generated typo-squatting names to trick developers into importing them. The malicious packages deploy a cross-platform RAT and infostealer that execute immediately upon import via require(), bypassing the need for install scripts. Payload delivery rotates through three Cloudflare Workers hosts with a DNS TXT record fallback under the domain wel1.ru. The macOS payload achieves persistence through LaunchAgents and downloads additional beacons, while the Linux payload appears to deliver a Sliver implant. The campaign shares tradecraft with the Moika malware operation, including targeting Russian financial institutions, fake telemetry for camouflage, and similar kill switch mechanisms. The malware includes anti-analysis features that detect debuggers, virtualization environments, and packet capture tools to evade detection and analysis.

The malicious NPM packages enable attackers to gain remote access and steal information across Windows, Linux, and macOS systems immediately upon package import. This can lead to unauthorized data access, system compromise, and persistence on infected macOS devices. The use of multiple payload delivery methods and anti-analysis techniques increases the difficulty of detection and mitigation. The campaign's focus on Russian financial institutions suggests targeted espionage or financial crime motives. The Linux payload's use of a Sliver implant indicates advanced post-exploitation capabilities.

No official patch or remediation is available as this is a supply chain malware campaign leveraging malicious packages in the NPM registry. Mitigation involves avoiding the use of suspicious or typo-squatted NPM packages, verifying package authenticity and publisher reputation before use, and monitoring for indicators of compromise such as connections to the listed domains (e.g., wel1.ru and its subdomains). Security teams should update detection rules to identify the hashes and domains associated with this campaign. Since this is not a vulnerability in software but a malware campaign, remediation focuses on supply chain security and package vetting.