Nearly 800 malicious packages have been published to the npm registry in a campaign delivering malware for Windows, macOS, and Linux. OpenSourceMalware researcher Paul McCarty said the packages carry a remote-access trojan and information-stealing payload. The packages appear to use randomly generated or AI-generated names, as well as names that imitate legitimate packages through typographical variations. Instead of relying on lifecycle hooks such as preinstall or postinstall, their README files instruct developers to load the modules with the built-in `require()` function. Doing so starts a downloader called WEL1DROPPER. WEL1DROPPER identifies the host operating system and processor architecture, then attempts to retrieve a compatible payload from one of three Cloudflare Workers hosts. If the HTTPS downloads fail, it switches to a platform-specific domain and uses DNS TXT records from `wel1[.]ru` to obtain the next stage. The retrieved payload is written to a temporary directory and executed with `/bin/sh` on Linux and macOS or `cmd.exe` on Windows. Sonatype, which tracks the campaign as Flooding Dropper, said the final stage runs as a detached process. On Windows, the malware patches Event Tracing for Windows and the Antimalware Scan Interface to interfere with monitoring. It checks for sandboxes and virtual environments, establishes persistence with a Registry Run key and scheduled task, and downloads and runs an encrypted executable named `update_win.exe`. The macOS chain similarly checks for debuggers and analysis artifacts before retrieving `beacon_mac.bin`. It can fall back to DNS TXT delivery and establish persistence through a LaunchAgent. The Linux sample is a UPX-packed ELF binary that downloads additional payloads from a Cloudflare Worker URL, ultimately deploying Sliver, an open-source command-and-control framework. The packages also contain `lib/telemetry.js`, a file that resembles a telemetry software development kit but includes the same downloader logic. OpenSourceMalware said its size and plausible analytics functions appear intended to create noise and make the malicious behavior look like ordinary profiling or telemetry during a quick review. The presence of `tcsbank[.]ru` and `cloudpayments[.]ru` in the macOS payload suggests the campaign may target Russian financial institutions and mobile-payment services. Researchers also suspect it is an evolution of the Moika dependency-confusion campaign, which was observed in April publishing more than 250 npm packages that collected environment information and delivered operating-system-specific second-stage payloads. Separately, Unit 42 reported that Chrome extensions marketed as game emulators, password managers, productivity tools, CSS inspectors, and Markdown converters contain a commercial bandwidth-sharing kit that can turn a browser into a web-crawling proxy. Commands arrive through a persistent WebSocket connection. The extensions load pages in hidden iframes, convert their content to Markdown, and send it to a remote cloud service. The proxy and crawling functions remain inactive when users decline, although some extensions present consent as necessary for uninterrupted service. Somali developers and IT students using npm should verify package names and review instructions before installing or importing dependencies, since this campaign delivers payloads compatible with all three major desktop operating systems.