Indicators of compromise · Sliver — 4 shown
38[.]60[.]179[.]31:3133738[.]60[.]179[.]31:844368[.]178[.]202[.]150:31337109[.]233[.]21[.]109:31337
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
OpenSourceMalware and Sonatype documented a campaign ('Flooding Dropper') of nearly 800 malicious npm packages using randomly generated typo-squatting names that deliver a cross-platform RAT/infostealer.
Key Details
- Source: The Hacker News
- Date: 2026-08-07
- Reliability: Tier 2/4 — Established cyber journalism
- Nature: Malicious open-source supply-chain packages
Summary
- Packages use a downloader (WEL1DROPPER) that identifies the OS and architecture
- Fetches payloads from Cloudflare Workers hosts or DNS TXT records (wel1[.]ru)
- Libraries Windows ETW/AMSI patches and persistence
- Deploys Sliver on Linux
- Payload domains reference Russian financial institutions, suggesting targeted espionage against Russian fintech and mobile payments
Analysis
The campaign adds to a sustained period of open-source/supply-chain attacks (following the NullReceiver, Keyv npm-worm, and Open VSX malicious-extension disclosures). Australian developers and enterprises consuming npm packages should treat registry packages as an untrusted input surface.
Sources: raw/digests/Cyber-Digest-2026-08-08.md