Flooding Dropper npm Campaign Drops Cross-Platform RAT

The Flooding Dropper npm campaign is the software supply chain story to watch this week. Researchers are tracking a sprawling operation that has pushed somewhere between roughly 800 and 850 malicious packages onto the npm registry, spread across hundreds of disposable publisher accounts. Each package carries a downloader that fingerprints the host and pulls a cross-platform remote access trojan and infostealer onto Windows, macOS, and Linux machines. Sonatype named the operation "Flooding Dropper" and tracks it as sonatype-2026-005660. OpenSourceMalware, which flagged the first sample, frames the same activity as AI-generated typosquatting that ends in a payload it calls WEL1DROPPER. Our incident catalog marked dozens of these packages critical on 2026-08-08, including a large cluster of finance-themed names.

What happened

Sonatype Research Labs reported an active malicious package campaign that, at the time of its writeup, involved 846 software components. Instead of publishing everything from one account, the operator generates many npm accounts and pushes a small number of packages from each. That account churn is the point. It spreads the campaign thin enough to slow down takedowns and frustrate registry moderation that relies on catching a single prolific publisher.

The package names are not entirely random noise. Sonatype observed names that interpolate strings such as "bigops" and "bnpl," with examples like bigops-api and dolyame-boxy-desktop-bnpl-card-gallery, plus recurring version numbers in the 35.x.y range. OpenSourceMalware researcher Paul McCarty characterized the names as AI slop-squatted or randomly generated typosquats that "all deliver a powerful RAT and infostealer payload."

One technique stands out. Many recent npm attacks abuse install lifecycle hooks such as preinstall or postinstall. Some Flooding Dropper packages still execute on install, but a notable variant ships a README that tells developers to import the package with require(), Node's built-in module loader. That shifts execution to import time and sidesteps defenses that only watch install scripts.

Timeline

• August 5, 2026: OpenSourceMalware reported a package named bigops-backend that delivered a platform-specific binary to Windows, Linux, and macOS. Sonatype's Jorge Cardona identified it as part of a much larger operation.
• August 5 to 6, 2026: Sonatype counted 846 implicated components and assigned the tracking id sonatype-2026-005660.
• August 7, 2026: The Hacker News reported the cluster at nearly 800 packages and described the WEL1DROPPER downloader fetching payloads from three Cloudflare Workers hosts.
• August 8, 2026: Our catalog flagged dozens of related packages as critical, including many under the sme-rko-finance-front prefix.

Who the Flooding Dropper campaign affects

Anyone who installed or imported one of these packages is in scope, on any major operating system. Because the loader is cross-platform, a Linux CI runner is as much a target as a macOS or Windows developer laptop. The install-or-import trigger also widens the blast radius past the usual install-script assumption.

The finance-themed naming is worth calling out. Dolyame is a Russian buy-now-pay-later brand, and RKO is a Russian term for small-business cash and settlement services. The catalog cluster flagged on 2026-08-08 leans heavily on those themes, with entries such as sme-rko-finance-front-payments-domain, sme-rko-finance-front-operations-domain, and titan-exchange-shared-permissions. Names like these read as attempts to match the internal package namespaces of specific fintech and exchange teams, which is the shape of a dependency confusion attack. Other flagged names are more generic, such as map-streak-kit, modern-localization, and @rbx-ts/services. The crypto stealer component also puts any developer who keeps wallet keys or seed phrases on a build machine at direct risk.

How the Flooding Dropper attack works

The first stage is JavaScript that acts as a cross-platform loader with several delivery paths. When the package runs, on install or when required, it launches a downloader that OpenSourceMalware tracks as WEL1DROPPER. WEL1DROPPER checks the host operating system and processor architecture, then requests a matching binary from one of three Cloudflare Workers endpoints. Using Workers as the delivery front puts the payload behind a reputable domain and makes simple network blocking harder.

Sonatype describes the second stage as multi-stage malware with cross-platform payloads, DNS fallback delivery, persistence, and in-memory execution. The packages also carry slightly modified payloads. They use different function and variable names from one package to the next, so the code looks different on the surface while doing the same thing. That variation defeats naive hash and signature matching, which is exactly what the account-churn strategy is built to exploit.

In a separate but related finding cited alongside this campaign, Palo Alto Networks Unit 42 examined a set of ten npm packages where each exports a getPlugin function that builds the payload URL and returns obfuscated code as an immediately invoked function expression embedded in a JSON object. Unit 42 said the payload "implements a crypto stealer and Remote-Access Trojan" that lets the attacker run arbitrary commands on the host. The end goals line up: steal secrets and wallets, then keep a foothold for command execution.

How to check if you are affected

Search your lockfiles and installed modules for the campaign's naming patterns and version range. Start here:

# look for campaign name fragments in lockfiles
grep -Ei 'bigops|bnpl|dolyame|sme-rko-finance-front|titan-exchange' \
  package-lock.json npm-shrinkwrap.json yarn.lock pnpm-lock.yaml 2>/dev/null

# list installed packages pinned to the 35.x.y version pattern
npm ls --all 2>/dev/null | grep -E '@35\.'

Check your own source for imports of an unfamiliar package by name, since some variants only run when required:

grep -rEn "require\(['\"](bigops|dolyame|sme-rko-finance-front|map-streak-kit|modern-localization)" . \
  --include='*.js' --include='*.ts'

Review recent outbound connections to Cloudflare Workers subdomains (*.workers.dev) from build agents and developer laptops. Then check DNS query logs for unusual TXT lookups, because the loader uses DNS as a fallback channel.

Remediation

Treat any host that installed one of these packages as compromised. Removing the package is not enough, because the dropper may have already fetched and run a second stage. Sonatype's guidance is to remove the package, investigate secondary payload execution and persistence, and rotate exposed credentials only after the environment is clean.

# remove the offending package
npm uninstall <package-name>

# wipe the npm cache so a poisoned tarball is not reused
npm cache clean --force

# reinstall from a known-good lockfile after cleanup
rm -rf node_modules
npm ci

Then work through the host itself:

# hunt for persistence on Linux/macOS
crontab -l 2>/dev/null
ls -la ~/.config/autostart 2>/dev/null
launchctl list 2>/dev/null | grep -vi apple

Rotate npm tokens, cloud keys, CI secrets, and any crypto wallet material that touched the host. If the machine is a shared CI runner, rebuild it from a clean image rather than cleaning in place. The in-memory execution reported by Sonatype means a running payload can persist without leaving an obvious file behind, so a clean rebuild is the safer default.

FAQ

Is the Flooding Dropper npm campaign still active?

Yes, the latest reports describe it as ongoing. Sonatype called it an active campaign and noted the count was still climbing, from a single reported sample on August 5 to 846 components shortly after. The disposable-account model means new packages can appear faster than any one name gets taken down, so treat the published lists as a snapshot, not a complete inventory.

How do I know if I installed a Flooding Dropper package?

Grep your lockfiles for the name fragments bigops, bnpl, dolyame, sme-rko-finance-front, and titan-exchange, and look for dependencies pinned in the 35.x.y range. Also search your code for require() calls that import packages you do not recognize, since some variants only run when imported rather than on install. If you find a match, assume the host ran a second-stage payload and move to remediation.

Does npm's install-script blocking stop this attack?

Not completely. Blocking preinstall and postinstall scripts helps against install-time execution, but the variant that instructs developers to load the package with require() runs its loader at import time. That is why import-time and runtime monitoring matter here, not just install hardening.

What is WEL1DROPPER?

WEL1DROPPER is the name OpenSourceMalware gave to the downloader stage in this campaign. It fingerprints the host operating system and CPU architecture, then pulls a matching cross-platform payload, a combined crypto stealer and remote access trojan, from one of three Cloudflare Workers hosts.