Audit log

Every state-changing event for WEL1DROPPER — 800 Malicious npm Packages RAT and Crypto Infostealer Campaign (August 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-15 23:18:21Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   GnPNA4MPmTJE…ATNy4MHEcopysha256 → base58

   verifying row…

   canonical bytes (27372 B) ▸

   {"actor":"system:backfill","investigation_id":"7638801f-7416-48e4-9f83-f287e3cb78d9","kind":"publish","page_slug":"wel1dropper-800-malicious-npm-packages-rat-and-crypto-infostealer-campaign-august-2026","published_at":"2026-08-15T23:18:21.697Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"WEL1DROPPER — 800 Malicious npm Packages RAT and Crypto Infostealer Campaign (August 2026)","sections":[{"content":"In August 2026, security researchers at OpenSourceMalware first identified a malicious npm package named 'bigops-backend' on August 5, 2026, that delivered platform-specific binaries to Windows, Linux, and macOS systems. Sonatype Research Labs subsequently tracked the broader operation under the campaign name 'Flooding Dropper' (internal ID: sonatype-2026-005660), identifying 846 malicious npm components as of their initial publication. OpenSourceMalware co-founder Jenn Gile reported to The Hacker News that the total number of confirmed packages reached 1,033. The malware downloader at the center of the campaign is named WEL1DROPPER. Rather than relying on npm lifecycle hooks (preinstall, postinstall) — a technique commonly monitored by security tooling — the packages included README files instructing developers to load them via a direct require() call, bypassing conventional detection. The campaign used disposable npm accounts publishing only a handful of packages each to prevent removal of any single publisher from eliminating the operation. Package names frequently interpolate business or SDK-themed terms such as 'bigops' and 'bnpl', with many packages sharing version numbers in the 35.x.y range — a correlation point noted by researchers as a non-durable detection mechanism since attackers were observed adapting naming patterns. The use of AI-assisted or randomly generated typosquatting names to mimic legitimate libraries at scale has led OpenSourceMalware to characterize the technique as 'AI slopsquatting.'","heading":"Campaign Overview","severity":"critical","sources":[{"credibility":2,"name":"Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html"},{"credibility":2,"name":"Flooding Dropper Hits npm With 850 Malicious Packages — Sonatype","type":"research","url":"https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages"},{"credibility":2,"name":"Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages — OpenSourceMalware","type":"research","url":"https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign"},{"credibility":2,"name":"Nearly 800 Malicious npm Packages Deliver Cross-Platform Malware — SC Media","type":"news_article","url":"https://www.scworld.com/brief/nearly-800-malicious-npm-packages-deliver-cross-platform-malware"}]},{"content":"WEL1DROPPER is a JavaScript first-stage downloader embedded in the malicious npm packages. When triggered via require(), it performs the following steps: (1) environmental checks including a rate-limit state marker file to avoid repeated execution; (2) detection of the host operating system and CPU architecture; (3) download of a platform-matched native binary payload from one of three hardcoded Cloudflare Workers hosts; and (4) execution of the binary as a detached background process, preventing termination through the npm or Node.js process hierarchy. If HTTPS delivery from Cloudflare Workers hosts fails, WEL1DROPPER falls back to a covert DNS channel: it queries DNS TXT records on platform-specific subdomains of wel1[.]ru (e.g., net.dl.wel1.ru, sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru), parses the returned value as a chunk count (accepting values between 1 and 2,000), requests numbered TXT records, joins the returned strings, and Base64-decodes the result into a binary buffer. This dual-channel delivery approach makes single-host blocking insufficient for defenders. Platform-specific second-stage payloads are: Windows — update_win.exe fetched from /pkg/update_win.exe, dropped temporarily to %TEMP%\\dotnet_diag_<8 hex characters>.exe; macOS — beacon_mac.bin with a similar anti-analysis framework; Linux — an UPX-packed ELF binary leading to the open-source Sliver C2 framework with section headers removed. Syntactic variation across packages (renamed variables and functions) was used to obstruct signature-based detection.","heading":"Technical Mechanism: WEL1DROPPER Payload Delivery","severity":"critical","sources":[{"credibility":2,"name":"Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html"},{"credibility":3,"name":"WEL1DROPPER npm Packages: Check Windows RAT Persistence — Trojan Killer","type":"research","url":"https://trojan-killer.net/wel1dropper-npm-packages-windows-rat/"},{"credibility":2,"name":"Flooding Dropper Hits npm With 850 Malicious Packages — Sonatype","type":"research","url":"https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages"},{"credibility":2,"name":"Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages — OpenSourceMalware","type":"research","url":"https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign"}]},{"content":"On Windows, the downloaded second-stage binary implements multiple defense-evasion techniques before establishing persistence. It patches Event Tracing for Windows (ETW) functions and interferes with the Antimalware Scan Interface (AMSI) to suppress security monitoring. It checks for the presence of debuggers, virtual machines, sandboxes, and security products, and aborts execution if these are detected. The payload then copies itself to a persistent location in the AppData directory and establishes two persistence mechanisms: a Registry Run key under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run (and optionally HKLM) and a scheduled task. The final encrypted stage is loaded reflectively in memory from the path /pkg/update_win.exe without writing to disk. The macOS payload, beacon_mac.bin, implements similar anti-analysis detection and establishes persistence via a LaunchAgent mechanism. Both variants are designed to function as full Remote Access Trojans (RAT) with infostealer capabilities, enabling the attacker to remotely control the compromised developer machine and steal credentials, tokens, and files. The malware reportedly includes a 'DRAIN' routine that checks cryptocurrency wallet balances and can siphon funds — including calculated amounts as small as 1% — or the entirety of balances, for Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP. The cryptocurrency drain capability has been reported by Cyber Recaps based on Sonatype research; this claim is attributed to secondary reporting and should be treated with medium confidence pending direct confirmation in Sonatype's primary publication.","heading":"Windows and macOS Payload Capabilities","severity":"critical","sources":[{"credibility":2,"name":"Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html"},{"credibility":3,"name":"Daily Cybersecurity News – August 8, 2026 — Cyber Recaps","type":"news_article","url":"https://cyberrecaps.com/news/cybersecurity-news-august-08-2026"},{"credibility":2,"name":"Flooding Dropper Hits npm With 850 Malicious Packages — Sonatype","type":"research","url":"https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages"}]},{"content":"The Linux variant of the WEL1DROPPER payload delivers an UPX-packed ELF binary with section headers removed to complicate static analysis. This binary leads to the deployment of Sliver, an open-source command-and-control (C2) framework originally developed for legitimate red-team and penetration-testing use. Sliver supports cross-platform implants, encrypted communications, and a broad set of post-exploitation capabilities, making it an increasingly common choice for threat actors seeking capable C2 infrastructure without the operational cost of developing a custom framework. ARM64 architecture support was also reported, indicating that the campaign targets not only traditional x86-64 Linux servers but also ARM-based developer environments. The use of a legitimate open-source C2 tool complicates attribution, as Sliver is used by a wide range of actors.","heading":"Linux Variant: Sliver C2 Framework","severity":"critical","sources":[{"credibility":2,"name":"Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html"},{"credibility":2,"name":"Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages — OpenSourceMalware","type":"research","url":"https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign"}]},{"content":"Researchers at OpenSourceMalware assess the WEL1DROPPER campaign as likely Russian in origin, based on several indicators. The primary C2 fallback domain, wel1[.]ru, is a Russian country-code TLD domain, and the presence of domains such as tcsbank[.]ru (associated with Tinkoff Credit Systems Bank) and cloudpayments[.]ru in the macOS payload suggests potential targeting of Russian financial institutions and mobile payment systems. The C2 infrastructure has been linked by researchers to Aeza Group, a Russian bulletproof hosting provider sanctioned by the U.S. government for supporting ransomware gangs and infostealer operations including BianLian ransomware and infostealers such as RedLine, Lumma, and Meduza. OpenSourceMalware further links the WEL1DROPPER campaign to the earlier Moika dependency-confusion operation (April–June 2026) based on shared tradecraft: both use 'oob'-named infrastructure (e.g., oob.moika.tech in Moika; oob-worker variants in WEL1DROPPER), fake telemetry camouflage framing, similar kill-switch mechanisms, and overlapping focus on Russian financial entities. This attribution is assessed with medium confidence; it is based on infrastructure and tradecraft overlap identified by private security researchers rather than any government finding, indictment, or admitted attribution. No specific named threat group or individual has been publicly identified by a government authority in connection with this campaign as of August 2026.","heading":"Attribution: Russian Threat Actor Assessment","severity":"high","sources":[{"credibility":2,"name":"Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages — OpenSourceMalware","type":"research","url":"https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign"},{"credibility":2,"name":"183 npm Packages Target Cloud and Finance via oob.moika.tech — SafeDep","type":"research","url":"https://safedep.io/oob-moika-tech-dependency-confusion-campaign/"},{"credibility":2,"name":"Aeza Group sanctioned for hosting ransomware, infostealer servers — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/aeza-group-sanctioned-for-hosting-ransomware-infostealer-servers/"},{"credibility":1,"name":"Russian bulletproof hosting service Aeza Group sanctioned by US for ransomware work — The Record","type":"news_article","url":"https://therecord.media/russia-bulletproof-hosting-aeza-group-us-sanctions"}]},{"content":"The Moika campaign was a dependency confusion operation documented in detail by SafeDep, which ran across multiple waves between late May and early June 2026. Wave 1 (May 27, 2026) involved two npm accounts publishing 164 malicious packages impersonating internal scopes of a cloud platform and financial services organization within 25 minutes. Wave 2 (May 29) added 12 packages targeting additional scopes including Sberbank's payment widget. Wave 3 (June 1) added further packages impersonating EMCD, a cryptocurrency exchange. All waves shared a single hardcoded C2 endpoint (https://oob.moika.tech/report) and a shared authentication secret, proving unified attribution across accounts. The Moika campaign exfiltrated raw process.env contents — potentially including cloud credentials, API tokens, and deployment secrets — to the attacker's server. Microsoft also documented related dependency confusion activity in a May 29, 2026 blog post identifying 33 malicious npm packages abusing the same technique. OpenSourceMalware's assessment that WEL1DROPPER is an evolution of Moika is based on overlapping infrastructure naming conventions and targeting patterns; the two campaigns are not identical, as WEL1DROPPER delivers native binary payloads (RAT + infostealer) where Moika focused on environment variable exfiltration. The progression suggests increasing operational sophistication by the assessed threat actor.","heading":"Relationship to Moika Dependency Confusion Campaign","severity":"high","sources":[{"credibility":2,"name":"183 npm Packages Target Cloud and Finance via oob.moika.tech — SafeDep","type":"research","url":"https://safedep.io/oob-moika-tech-dependency-confusion-campaign/"},{"credibility":1,"name":"Malicious npm packages abuse dependency confusion to profile developer environments — Microsoft Security Blog","type":"research","url":"https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/"},{"credibility":2,"name":"moika.tech. It's just telemetry. I promise. — Very Serious Systems Research","type":"research","url":"https://research.veryserious.systems/moika-tech-its-just-telemetry-i-promise/"},{"credibility":2,"name":"oob-moika-tech-depconf-2026 Campaign — SafeDep Threat Intelligence","type":"research","url":"https://safedep.io/ti/campaigns/oob-moika-tech-depconf-2026/"}]},{"content":"Concurrent with the WEL1DROPPER/Flooding Dropper campaign, OX Security published a separate report attributing a distinct npm RAT campaign to a North Korean-linked threat actor. That campaign centered on a package named 'terminal-logger-utils' (published by npm account 'jpeek895'), which delivered keylogger, infostealer, and RAT functionality targeting Telegram data, SSH keys, cryptocurrency wallets, cloud configurations (AWS, GCP, Azure), and environment variables. Three dependent packages imported it: pretty-logger-utils, ts-logger-pack, and pinno-loggers. Attribution was made by OX Security and kmsec.uk to a threat cluster linked to FAMOUS CHOLLIMA (also tracked as Contagious Interview), a DPRK-affiliated group known for targeting developers through poisoned npm packages and fake job interviews. This North Korean campaign is a distinct operation from WEL1DROPPER and uses different infrastructure, delivery methods (postinstall hooks), and C2 architecture. The two campaigns should not be conflated. The OX Security article linked in the original context appears to describe this separate North Korean campaign rather than WEL1DROPPER specifically.","heading":"Separate North Korean npm Campaign (OX Security Report)","severity":"high","sources":[{"credibility":2,"name":"North Korean-Linked Threat Actor Targets Developers with New npm Infostealer RAT — OX Security","type":"research","url":"https://www.ox.security/blog/north-korean-npm-infostealer-rat/"},{"credibility":1,"name":"North Korean Hackers Blamed for Mastra NPM Supply Chain Attack — SecurityWeek","type":"news_article","url":"https://www.securityweek.com/north-korean-hackers-blamed-for-mastra-npm-supply-chain-attack/"}]},{"content":"The campaign's primary attack surface is the software development pipeline. Developers who install any of the malicious packages and subsequently invoke require() on the module trigger WEL1DROPPER on their local machine or within a CI/CD runner. A compromised developer machine provides the attacker with access to all credentials, tokens, SSH keys, and cloud configurations present in the developer's environment — as well as potential lateral movement into internal networks and production systems the developer can access. A CI/CD runner compromise with active cloud credentials constitutes a full credential compromise of the connected cloud environment. The campaign's deliberate requirement of a manual require() call — rather than lifecycle hooks — may reduce the attack surface compared to hook-based campaigns (packages that never get require()-ed will not trigger the payload), but it also means that the malicious code executes in contexts where the developer is actively using the library, potentially in production tooling and build pipelines. Because the campaign uses hundreds of unique package names across many accounts, complete removal from the npm registry is operationally difficult and requires ongoing monitoring. Sonatype advises affected organizations to treat compromised hosts as fully compromised, isolate affected systems, hunt for persistence mechanisms (Registry Run keys, scheduled tasks, LaunchAgent entries), rotate all credentials accessible from the compromised machine, and verify replacement package names before installation.","heading":"Supply Chain Risk and Developer Impact","severity":"critical","sources":[{"credibility":2,"name":"Flooding Dropper Hits npm With 850 Malicious Packages — Sonatype","type":"research","url":"https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages"},{"credibility":2,"name":"Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html"},{"credibility":2,"name":"183 npm Packages Target Cloud and Finance via oob.moika.tech — SafeDep","type":"research","url":"https://safedep.io/oob-moika-tech-dependency-confusion-campaign/"}]},{"content":"Known indicators of compromise associated with the WEL1DROPPER campaign include: Infrastructure domains — wel1[.]ru and subdomains including net.dl.wel1.ru, sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru; Cloudflare Workers delivery hosts with 'oob-worker' naming patterns; domains tcsbank[.]ru and cloudpayments[.]ru observed in macOS payload strings. File artifacts (Windows) — temporary dropper at %TEMP%\\dotnet_diag_<8 hex characters>.exe; rate-limit marker file at %TEMP%\\analytics_state; payload path /pkg/update_win.exe; payload path /pkg/package.exe. Persistence artifacts (Windows) — Registry Run key at HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run; additional Run key at HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run; scheduled task created during execution. Package naming patterns — terms including 'bigops' and 'bnpl' combined with other words; version numbers frequently in the 35.x.y range. Campaign tracking ID — sonatype-2026-005660. These indicators should be cross-referenced against the Sonatype advisory and OpenSourceMalware reporting for the most current list, as the campaign was observed adapting naming conventions during the active phase.","heading":"Indicators of Compromise","severity":"high","sources":[{"credibility":3,"name":"WEL1DROPPER npm Packages: Check Windows RAT Persistence — Trojan Killer","type":"research","url":"https://trojan-killer.net/wel1dropper-npm-packages-windows-rat/"},{"credibility":2,"name":"Flooding Dropper Hits npm With 850 Malicious Packages — Sonatype","type":"research","url":"https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages"},{"credibility":2,"name":"Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages — OpenSourceMalware","type":"research","url":"https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign"}]}],"sources_used":[{"credibility":2,"name":"Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html"},{"credibility":2,"name":"Flooding Dropper Hits npm With 850 Malicious Packages — Sonatype","type":"research","url":"https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages"},{"credibility":2,"name":"Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages — OpenSourceMalware","type":"research","url":"https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign"},{"credibility":2,"name":"Nearly 800 Malicious npm Packages Deliver Cross-Platform Malware — SC Media","type":"news_article","url":"https://www.scworld.com/brief/nearly-800-malicious-npm-packages-deliver-cross-platform-malware"},{"credibility":2,"name":"North Korean-Linked Threat Actor Targets Developers with New npm Infostealer RAT — OX Security","type":"research","url":"https://www.ox.security/blog/north-korean-npm-infostealer-rat/"},{"credibility":2,"name":"183 npm Packages Target Cloud and Finance via oob.moika.tech — SafeDep","type":"research","url":"https://safedep.io/oob-moika-tech-dependency-confusion-campaign/"},{"credibility":2,"name":"oob-moika-tech-depconf-2026 Campaign — SafeDep Threat Intelligence","type":"research","url":"https://safedep.io/ti/campaigns/oob-moika-tech-depconf-2026/"},{"credibility":2,"name":"moika.tech. It's just telemetry. I promise. — Very Serious Systems Research","type":"research","url":"https://research.veryserious.systems/moika-tech-its-just-telemetry-i-promise/"},{"credibility":1,"name":"Malicious npm packages abuse dependency confusion to profile developer environments — Microsoft Security Blog","type":"research","url":"https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/"},{"credibility":2,"name":"Aeza Group sanctioned for hosting ransomware, infostealer servers — BleepingComputer","type":"news_article","url":"https://www.bleepingcomputer.com/news/security/aeza-group-sanctioned-for-hosting-ransomware-infostealer-servers/"},{"credibility":1,"name":"Russian bulletproof hosting service Aeza Group sanctioned by US for ransomware work — The Record","type":"news_article","url":"https://therecord.media/russia-bulletproof-hosting-aeza-group-us-sanctions"},{"credibility":3,"name":"WEL1DROPPER npm Packages: Check Windows RAT Persistence — Trojan Killer","type":"research","url":"https://trojan-killer.net/wel1dropper-npm-packages-windows-rat/"},{"credibility":3,"name":"Daily Cybersecurity News – August 8, 2026 — Cyber Recaps","type":"news_article","url":"https://cyberrecaps.com/news/cybersecurity-news-august-08-2026"},{"credibility":1,"name":"North Korean Hackers Blamed for Mastra NPM Supply Chain Attack — SecurityWeek","type":"news_article","url":"https://www.securityweek.com/north-korean-hackers-blamed-for-mastra-npm-supply-chain-attack/"},{"credibility":2,"name":"Russian Hackers Use AI Slopsquatting to Publish 700+ Malicious npm Packages — GBHackers","type":"news_article","url":"https://gbhackers.com/russian-hackers-use-ai-slopsquatting/"}],"summary":"WEL1DROPPER is a cross-platform malware downloader distributed through a large-scale npm supply-chain campaign, tracked by Sonatype as 'Flooding Dropper' (sonatype-2026-005660), which published between 788 and 1,033 confirmed malicious packages to the npm registry in August 2026. Upon execution via a developer's require() call, WEL1DROPPER fingerprints the host OS and fetches a platform-specific Remote Access Trojan and infostealer payload — with the Linux variant deploying the open-source Sliver C2 framework. Researchers at OpenSourceMalware assess the campaign as an evolution of the earlier Moika dependency-confusion operation, link C2 infrastructure to Aeza Group (a sanctioned Russian bulletproof host), and report a cryptocurrency drain routine capable of siphoning Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and XRP. A separate OX Security report from approximately the same period attributes a related but distinct npm RAT campaign to a North Korean-linked threat actor; the two campaigns share the npm supply-chain vector but have distinct infrastructure and attribution.","timeline":[{"date":"2026-04-01","event":"Moika dependency confusion campaign begins: over 250 malicious npm packages published, exfiltrating process.env contents and delivering OS-specific second-stage payloads. Assessed by OpenSourceMalware as a predecessor to WEL1DROPPER.","source":"SafeDep Threat Intelligence / OpenSourceMalware","source_url":"https://safedep.io/ti/campaigns/oob-moika-tech-depconf-2026/"},{"date":"2026-05-27","event":"Moika Wave 1: npm accounts mr.4nd3r50n and pik-libs publish 164 malicious packages targeting cloud platform and financial services internal scopes within 25 minutes.","source":"SafeDep","source_url":"https://safedep.io/oob-moika-tech-dependency-confusion-campaign/"},{"date":"2026-05-29","event":"Moika Wave 2: Third account t-in-one adds 12 packages, including impersonation of Sberbank's payment widget. Microsoft Security Blog separately documents 33 malicious npm packages abusing dependency confusion.","source":"SafeDep / Microsoft Security Blog","source_url":"https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/"},{"date":"2026-06-01","event":"Moika Wave 3: Fourth account emcd-vue publishes packages impersonating EMCD cryptocurrency exchange with advanced obfuscation.","source":"SafeDep","source_url":"https://safedep.io/oob-moika-tech-dependency-confusion-campaign/"},{"date":"2026-08-05","event":"OpenSourceMalware researchers identify bigops-backend as the first documented WEL1DROPPER package, triggering a cross-platform native binary payload on Windows, Linux, and macOS.","source":"The Hacker News / OpenSourceMalware","source_url":"https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html"},{"date":"2026-08-06","event":"OpenSourceMalware publishes analysis of the AI slopsquatting campaign, documenting 700+ malicious npm packages published in approximately 48 hours and naming the campaign 'WEL1DROPPER'.","source":"OpenSourceMalware","source_url":"https://opensourcemalware.com/blog/russian-ai-slopsquatting-npm-campaign"},{"date":"2026-08-07","event":"Sonatype Research Labs publishes campaign tracking under the name 'Flooding Dropper' (sonatype-2026-005660), identifying 846 malicious npm components. Campaign velocity reportedly slowed after discovery week.","source":"Sonatype","source_url":"https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages"},{"date":"2026-08-08","event":"SC Media and other outlets publish coverage. OpenSourceMalware co-founder Jenn Gile reports total confirmed WEL1DROPPER packages at 1,033.","source":"SC Media / The Hacker News","source_url":"https://www.scworld.com/brief/nearly-800-malicious-npm-packages-deliver-cross-platform-malware"},{"date":"2026-08-10","event":"The Hacker News publishes comprehensive coverage citing Sonatype and OpenSourceMalware research, describing 1,033 total packages, crypto drain capabilities, Aeza Group infrastructure link, and connection to Moika campaign.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/08/nearly-800-malicious-npm-packages.html"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a28693ca-bacb-4afd-9970-3627c9184189copy