A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload," OpenSourceMalware researcher Paul McCarty said. "The payload implements a crypto stealer and Remote-Access Trojan (RAT) that allows the attacker to execute arbitrary commands on the infected host." UpdateOpenSourceMalware's co-founder Jenn Gile told The Hacker News that the WEL1DROPPER campaign has involved a total of 1,033 confirmed packages so far. "The Flooding Dropper threat actors are using account names that appear randomly generated, and individual accounts publish only a handful of packages," Sonatype said.