{"id":4768,"date":"2026-08-07T17:13:01","date_gmt":"2026-08-07T17:13:01","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/07\/flooding-dropper-is-hitting-npm-with-a-tidal-wave-of-malicious-packages\/"},"modified":"2026-08-07T17:13:01","modified_gmt":"2026-08-07T17:13:01","slug":"flooding-dropper-is-hitting-npm-with-a-tidal-wave-of-malicious-packages","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/08\/07\/flooding-dropper-is-hitting-npm-with-a-tidal-wave-of-malicious-packages\/","title":{"rendered":"\u2018Flooding Dropper\u2019 Is Hitting npm With a Tidal Wave of Malicious Packages"},"content":{"rendered":"
\"\"<\/div>\n

\"\"<\/p>\n

Threat researchers at Sonatype are warning developers of an expanding campaign that is generating a wide range of npm accounts<\/a> and dropping small numbers of malicious packages from each one, essentially flooding the zone with a broadly distributed and automated campaign to make it difficult for defenders to keep up.<\/p>\n

So far, the campaign \u2013 dubbed \u201cFlooding Dropper\u201d \u2013 has affected almost 850 software components and comes with a package naming convention that initially contained terms such as \u201cbigops\u201d and \u201cbnpl,\u201d as seen in bigops-api and dolyame-boxy-desktop-bnpl-card-gallery. However, even that is evolving, with researchers seeing packages being created with other names.<\/p>\n

Overall, the nature of the campaign showcases growing trends of threat actors turning the publication of malicious packages into a more scalable operation and using open source malware in distributed and automated campaigns \u2013 rather than individual packages \u2013 to overwhelm registry moderation and blocklists.<\/p>\n

\u201cPublishing malicious packages at scale is not new,\u201d the researchers wrote in a report<\/a>. \u201cDistributing them across many disposable accounts makes containment harder. The Flooding Dropper threat actors are using account names that appear randomly generated, and individual accounts publish only a handful of packages. That prevents defenders from assuming that removing one prolific publisher will eliminate the broader operation.\u201d<\/p>\n

More Pressure on npm<\/h3>\n

For npm, the campaign creates a moderation problem, they added, noting that \u201ceach account and package may need to be identified, reviewed, and removed independently while the attacker continues generating more.\u201d It adds even more pressure to the code repository, which Sonatype noted in its Q2 2026 Open Source Malware Index<\/a> accounted for 96.6% of malicious package counts during the quarter. Sonatype has logged more than 1.8 million malicious packages across ecosystems over the past decade.<\/p>\n

The team at OpenSourceMalware, a community-driven threat intelligence platform and database, this week reported on a malicious npm package<\/a> with the name \u201cbigops-backend\u201d that delivered a binary specific to Windows, Linux, and macOS systems. However, Jorge Cardona, a security researcher with Sonatype Research Labs, found that the package was part of a larger campaign.<\/p>\n

Making Detection Harder<\/h3>\n

Sonatype researchers, who are tracking the campaign under the sonatype-2026-005660<\/a> identifier, wrote that the packages all deliver the same behaviors, but the evolving naming pattern and slightly modified payloads \u2013 including variable names and different URL functions \u2013 \u201ccan reduce the effectiveness of detections that depend on exact signatures, even when the underlying behavior remains closely related.\u201d<\/p>\n

The malicious code in the packages runs when they\u2019re installed or imported.<\/p>\n

The First Stage<\/h3>\n

The first stage involves a JavaScript-based cross-platform loader with various delivery paths. It checks the environment to see if it should run, identifies the host OS and processor before deciding on the Windows, Linux, or macOS payload, and then tries to download the binary from a set of remote hosts.<\/p>\n

If the direct HTTPS downloads fail, it will fall back to DNS TXT records, reassembling and decoding the DNS-delivered payload, writing the binary to a temporary directory and marking it \u201cexecutable\u201d on Unix-like systems, and launching it as a detached background process with output suppressed.<\/p>\n

The researchers wrote that launching the payload in a detached process is a failsafe, as stopping the npm installation process or parent Node.js process doesn\u2019t lead to stopping the attack because the binary can still run independently in the background.<\/p>\n

\u201cThe DNS fallback is also significant,\u201d they wrote. \u201cBlocking one download host may not prevent delivery when the malware can reconstruct the payload from TXT-record responses.\u201d<\/p>\n

The Second Stage<\/h3>\n

In evaluating the second stage, the researchers noted the Windows binary is also a loader for another payload that searches for capabilities that could interfere with monitoring and scanning, checks for virtual machines, sandboxes, and security tools, copies itself to a persistent location under the user\u2019s AppData directory, and establishes persistence via a Registry Run key as well as a scheduled task.<\/p>\n

It also downloads an encrypted payload, decrypts it, and reflectively executes it in memory. The reflective loading enables the malware to execute a payload without the normal process of writing and launching a conventional executable from disk, making it more difficult for disk-focused controls to detect.<\/p>\n

Don\u2019t Rely on Naming Conventions<\/h3>\n

Sonatype warned developers not to rely on the bigops and bnpl names as the only indicators of threats associated with the Flooding Dropper campaign.<\/p>\n

\u201cAttackers can change names more easily than they can change the purpose of their malware,\u201d the researchers wrote. \u201cThe same is true of minor source-code modifications intended to avoid exact signature matches. A blocklist of known names can help with yesterday\u2019s packages; behavioral and similarity analysis are what help find tomorrow\u2019s variation.\u201d<\/p>\n

They laid out a range of steps that infected organizations need to take, including assuming that the host is compromised, removing the package, investigating secondary payload execution and persistence, and rotating exposed credentials after the environment has been cleaned.<\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

Threat researchers at Sonatype are warning developers of an expanding campaign that is generating a wide range of npm accounts […]<\/p>\n","protected":false},"author":1,"featured_media":4769,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-4768","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=4768"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/4768\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/4769"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=4768"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=4768"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=4768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}