TL;DR — Key Takeaways
- A sprawling npm malware campaign has already pushed nearly 850 malicious packages by spreading them across hundreds of disposable accounts, making it far harder for defenders to identify and shut down the operation.
- Sonatype says the “Flooding Dropper” campaign uses stealthy, multi-stage malware with cross-platform payloads, DNS fallback delivery, persistence mechanisms, and in-memory execution to evade detection on Windows, Linux, and macOS.
- The campaign highlights a shift toward industrial-scale open source attacks, where attackers rely on automation, behavioral variation, and account churn—not just malicious code—to overwhelm registry moderation and signature-based defenses.
Threat researchers at Sonatype are warning developers of an expanding campaign that is generating a wide range of npm accounts and dropping small numbers of malicious packages from each one, essentially flooding the zone with a broadly distributed and automated campaign to make it difficult for defenders to keep up.
So far, the campaign – dubbed “Flooding Dropper” – has affected almost 850 software components and comes with a package naming convention that initially contained terms such as “bigops” and “bnpl,” as seen in bigops-api and dolyame-boxy-desktop-bnpl-card-gallery. However, even that is evolving, with researchers seeing packages being created with other names.
Overall, the nature of the campaign showcases growing trends of threat actors turning the publication of malicious packages into a more scalable operation and using open source malware in distributed and automated campaigns – rather than individual packages – to overwhelm registry moderation and blocklists.
“Publishing malicious packages at scale is not new,” the researchers wrote in a report. “Distributing them across many disposable accounts makes containment harder. The Flooding Dropper threat actors are using account names that appear randomly generated, and individual accounts publish only a handful of packages. That prevents defenders from assuming that removing one prolific publisher will eliminate the broader operation.”
More Pressure on npm
For npm, the campaign creates a moderation problem, they added, noting that “each account and package may need to be identified, reviewed, and removed independently while the attacker continues generating more.” It adds even more pressure to the code repository, which Sonatype noted in its Q2 2026 Open Source Malware Index accounted for 96.6% of malicious package counts during the quarter. Sonatype has logged more than 1.8 million malicious packages across ecosystems over the past decade.
The team at OpenSourceMalware, a community-driven threat intelligence platform and database, this week reported on a malicious npm package with the name “bigops-backend” that delivered a binary specific to Windows, Linux, and macOS systems. However, Jorge Cardona, a security researcher with Sonatype Research Labs, found that the package was part of a larger campaign.
Making Detection Harder
Sonatype researchers, who are tracking the campaign under the sonatype-2026-005660 identifier, wrote that the packages all deliver the same behaviors, but the evolving naming pattern and slightly modified payloads – including variable names and different URL functions – “can reduce the effectiveness of detections that depend on exact signatures, even when the underlying behavior remains closely related.”
The malicious code in the packages runs when they’re installed or imported.
The First Stage
The first stage involves a JavaScript-based cross-platform loader with various delivery paths. It checks the environment to see if it should run, identifies the host OS and processor before deciding on the Windows, Linux, or macOS payload, and then tries to download the binary from a set of remote hosts.
If the direct HTTPS downloads fail, it will fall back to DNS TXT records, reassembling and decoding the DNS-delivered payload, writing the binary to a temporary directory and marking it “executable” on Unix-like systems, and launching it as a detached background process with output suppressed.
The researchers wrote that launching the payload in a detached process is a failsafe, as stopping the npm installation process or parent Node.js process doesn’t lead to stopping the attack because the binary can still run independently in the background.
“The DNS fallback is also significant,” they wrote. “Blocking one download host may not prevent delivery when the malware can reconstruct the payload from TXT-record responses.”
The Second Stage
In evaluating the second stage, the researchers noted the Windows binary is also a loader for another payload that searches for capabilities that could interfere with monitoring and scanning, checks for virtual machines, sandboxes, and security tools, copies itself to a persistent location under the user’s AppData directory, and establishes persistence via a Registry Run key as well as a scheduled task.
It also downloads an encrypted payload, decrypts it, and reflectively executes it in memory. The reflective loading enables the malware to execute a payload without the normal process of writing and launching a conventional executable from disk, making it more difficult for disk-focused controls to detect.
Don’t Rely on Naming Conventions
Sonatype warned developers not to rely on the bigops and bnpl names as the only indicators of threats associated with the Flooding Dropper campaign.
“Attackers can change names more easily than they can change the purpose of their malware,” the researchers wrote. “The same is true of minor source-code modifications intended to avoid exact signature matches. A blocklist of known names can help with yesterday’s packages; behavioral and similarity analysis are what help find tomorrow’s variation.”
They laid out a range of steps that infected organizations need to take, including assuming that the host is compromised, removing the package, investigating secondary payload execution and persistence, and rotating exposed credentials after the environment has been cleaned.
Frequently Asked Questions
What is the Flooding Dropper campaign?
Flooding Dropper is a malicious npm campaign that distributes small numbers of harmful packages across many disposable accounts, making detection and removal more difficult.
