Cybersecurity researchers have identified a new supply chain attack using typo-squatted packages that deploy malicious payloads like the Sliver framework across Windows, macOS, and Linux development environments.

Key Points

• Attackers use AI-generated, typo-squatted package names to trick developers into importing malicious code via standard require() calls.
• The WEL1DROPPER malware retrieves payloads from Cloudflare Workers or via DNS TXT records under the wel1.ru domain as a fallback.
• Windows variants actively disable security monitoring tools like ETW and AMSI to maintain persistence and evade sandbox detection.
• The malware deploys platform-specific persistence mechanisms, including Registry Run entries on Windows and LaunchAgents on macOS.
• Security teams should audit lockfiles, build logs, and DNS traffic for indicators of compromise related to the wel1.ru domain.

Why it Matters

This campaign highlights a sophisticated shift in supply chain attacks that bypass traditional installation-script detection by requiring manual code integration. Organizations must treat any compromised CI runner or workstation as fully breached, necessitating immediate credential rotation and deep forensic investigation.