Executive Overview
The open-source software supply chain is facing a relentless, highly structured assault. Threat researchers at Sonatype have issued an urgent warning to software developers and cybersecurity teams worldwide regarding an expanding, highly automated malware distribution campaign dubbed "Flooding Dropper." Tracked under the internal identifier sonatype-2026-005660, this malicious operation targets the Node Package Manager (npm) registry by leveraging an unprecedented volume of disposable accounts, fragmented payloads, and decentralized infrastructure.
Rather than relying on a single, highly visible publisher account or a monolithic malicious package, the threat actors behind Flooding Dropper have chosen a strategy of radical dispersion. By flooding the ecosystem with hundreds of distinct, seemingly random components managed by automated burner accounts, the campaign deliberately overwhelms registry moderation queues, bypasses basic signature-based detection mechanisms, and defies traditional blocklisting strategies.
As of this writing, the campaign has compromised or generated nearly 850 distinct software components within the npm registry. While initially identified through specific naming conventions—such as terms like "bigops" and "bnpl" (e.g., bigops-api and dolyame-boxy-desktop-bnpl-card-gallery)—the operation has evolved rapidly, altering its naming schemes, obfuscating source code variables, and modifying URL routing functions to evade exact-match rules.
This sophisticated campaign highlights a broader, alarming trend within the cybersecurity landscape: threat actors are industrializing open-source abuse. By transforming the publication of malicious packages into a scalable, high-volume automated service, attackers are turning the open nature of registries like npm against the very developers who rely on them. The implications of this campaign extend far beyond a single registry; they expose systemic vulnerabilities in how automated package managers verify trust, how security tools detect multi-stage malware, and how organizations must adapt their defensive postures to protect modern software development life cycles (SDLCs).
Detailed Chronology and Technical Breakdown of the Infection Chain
To fully understand the severity of the Flooding Dropper campaign, security professionals must examine its mechanics. The attack relies on an intricate, multi-stage infection process designed to achieve cross-platform execution, evade conventional monitoring tools, and establish resilient persistence on compromised endpoints.
The Ingress and Trigger Mechanics
The malicious cycle begins the moment a developer installs or imports an infected package into their project. Because the campaign is distributed across hundreds of disposable accounts publishing only a handful of components each, engineers cannot rely on publisher reputation or project popularity metrics to vet dependencies.
Upon installation, the package executes an initial JavaScript-based, cross-platform loader. This ingress script performs a reconnaissance check of the local environment to ensure optimal execution conditions. It interrogates the host operating system and processor architecture, identifying whether the underlying system runs Windows, Linux, or macOS. Once the platform is verified, the loader initiates attempts to download a tailored, secondary-stage binary from a hardcoded list of remote command-and-control (C2) hosts over HTTPS.
The DNS Fallback Mechanism: Resilient Payload Delivery
One of the most notable technical innovations observed in the Flooding Dropper campaign is its fallback delivery mechanism. Recognizing that defenders frequently block malicious IP addresses and domain names, the threat actors engineered a robust contingency plan: DNS-based payload retrieval.
If direct HTTPS communication fails or the primary C2 servers are unreachable, the loader transitions to querying DNS TXT records. The malware queries specifically formatted DNS domains, receiving fragments of the encrypted payload embedded within the text records. The loader then programmatically reassembles and decodes these fragments.
Once the binary is successfully reconstructed, it is written directly to a temporary directory on the host machine. On Unix-like systems (Linux and macOS), the script programmatically marks the file as executable (chmod +x).
To ensure the installation process or the parent Node.js process cannot interrupt the attack, the loader executes the binary as a detached background process with all standard output streams suppressed. Security researchers emphasize that this is a critical failsafe: even if a developer or CI/CD pipeline immediately terminates the npm install command upon noticing suspicious behavior, the rogue binary continues executing independently in the background. Furthermore, the reliance on DNS TXT records means that blocking a single download host is wholly insufficient to stem the tide of the infection.
Stage-Two Execution and Evasion on Windows Systems
When the malware successfully executes on Windows environments, the secondary binary acts as an advanced loader for a tertiary payload. This component is heavily armored against analysis and forensic inspection. It begins by systematically searching the host system for capabilities, processes, and artifacts that could interfere with its operation, actively checking for:
- Virtual machine (VM) and sandbox environments.
- Active security tools, endpoint detection and response (EDR) agents, and antivirus solutions.
- Debugging utilities and analysis toolsets.
Once the environment is deemed safe from scrutiny, the payload establishes persistence. It copies itself into a concealed location within the user’s local AppData directory and establishes system persistence through two primary vectors:
- Registry Run Keys: Modifying the Windows Registry to ensure execution upon user logon.
- Scheduled Tasks: Registering a persistent task within the Windows Task Scheduler to guarantee ongoing execution cycles.
Finally, the stage-two loader requests an encrypted payload from its infrastructure. Once downloaded, it decrypts the file and executes it via reflective loading. By injecting the payload directly into memory rather than writing a conventional executable to disk, the malware evades disk-focused security controls, traditional antivirus file scanners, and static file-integrity monitoring tools.
Supporting Context & Metrics: The Pressure on npm
The Flooding Dropper campaign does not exist in a vacuum; it is symptomatic of an escalating crisis within the open-source software supply chain. Public repositories, designed for frictionless collaboration and rapid code sharing, have become prime targets for financially and geopolitically motivated threat actors alike.
The npm Monopoly on Open Source Malware
Data compiled in Sonatype’s Q2 2026 Open Source Malware Index underscores the disproportionate burden placed on the npm ecosystem. According to the report, npm accounted for a staggering 96.6% of all malicious package counts identified across major open-source ecosystems during the quarter. Over the past decade, Sonatype has logged more than 1.8 million malicious packages across various open-source registries, with npm consistently acting as the primary battleground.
This concentration of malicious activity is driven by several ecosystem characteristics:
- Low Barrier to Entry: Creating an account and publishing a package to npm requires minimal friction, making it ideal for automated account generation.
- Deep Dependency Trees: Modern JavaScript and TypeScript applications often rely on hundreds—sometimes thousands—of transitive dependencies, making manual auditing virtually impossible.
- Implicit Trust: Developers routinely trust packages with high download counts or innocuous-sounding utility names, a psychological vulnerability that attackers exploit through typosquatting and dependency confusion.
The Moderation Dilemma
The tactics deployed in the Flooding Dropper campaign exacerbate these systemic challenges. Traditionally, registry moderators and automated security scanners could mitigate a campaign by identifying a prolific publisher account, banning it, and purging its associated packages.
Flooding Dropper turns this defensive playbook on its head. By distributing 850 packages across hundreds of unique, randomly generated burner accounts—each publishing only a handful of components—the campaign forces registry moderators to review, evaluate, and remove accounts and packages on an individual, piecemeal basis. As defenders struggle to clip individual branches, the attackers continue seeding new accounts, creating an unsustainable game of technological whack-a-mole.
Independent threat intelligence platforms have also felt the shockwaves. Security analysts at OpenSourceMalware—a community-driven threat intelligence database—recently flagged a package named bigops-backend that delivered platform-specific binaries for Windows, Linux, and macOS. Subsequent analysis by Jorge Cardona and his colleagues at Sonatype Research Labs revealed that bigops-backend was merely a single pixel in a much larger, highly coordinated mosaic.
Official Statements and Industry Perspectives
Security researchers and open-source maintainers have expressed deep concern over the operational maturity demonstrated by the Flooding Dropper campaign. The shift toward automated, fragmented, and decentralized distribution models signals that threat actors are professionalizing their operations.
In their comprehensive technical report, the Sonatype research team detailed the psychological and operational hurdles introduced by the campaign:
"Publishing malicious packages at scale is not new," the researchers wrote. "Distributing them across many disposable accounts makes containment harder. The Flooding Dropper threat actors are using account names that appear randomly generated, and individual accounts publish only a handful of packages. That prevents defenders from assuming that removing one prolific publisher will eliminate the broader operation."
The report highlights the sheer administrative and technical overhead placed on registry administrators:
"Each account and package may need to be identified, reviewed, and removed independently while the attacker continues generating more."
Furthermore, the research team emphasized the futility of relying on static indicators of compromise (IoCs), such as hardcoded package names or simple file hashes:
"Attackers can change names more easily than they can change the purpose of their malware. The same is true of minor source-code modifications intended to avoid exact signature matches. A blocklist of known names can help with yesterday’s packages; behavioral and similarity analysis are what help find tomorrow’s variation."
Cybersecurity analysts across the industry echo these warnings, noting that the modularity of modern software supply chain attacks requires a fundamental shift in defensive architecture. Organizations can no longer rely on perimeter defenses or point-in-time vulnerability scans to catch sophisticated multi-stage loaders that execute within memory and utilize DNS tunneling for C2 recovery.
Remediation, Mitigation, and Future Outlook
Mitigating the risks posed by campaigns like Flooding Dropper requires a multi-layered defense strategy that spans developer hygiene, automated tooling, and rigorous incident response protocols. Organizations must assume that traditional blocklists and static naming conventions are insufficient protection against modern, automated supply chain threats.
Recommended Steps for Infected Organizations
If an organization discovers that a Flooding Dropper component has been introduced into its environment, security teams must execute a comprehensive incident response procedure:
- Assume Total Compromise: Treat any host or CI/CD runner that executed the infected package as fully compromised. Do not assume that terminating the npm installation process halted the attack, given the malware’s ability to spawn detached background processes.
- Isolate and Remove: Immediately quarantine the affected system and remove the malicious package from project manifests (
package.json,package-lock.json,pnpm-lock.yaml, etc.). - Investigate Secondary Execution: Conduct deep forensic analysis to check for unauthorized binaries in temporary directories, persistent registry keys, and scheduled tasks (on Windows) or hidden cron jobs and daemon processes (on Linux/macOS).
- Credential Rotation: Because the malware is capable of harvesting environment variables, local configuration files, and developer credentials, organizations must rotate all API keys, database credentials, cloud infrastructure tokens, and SSH keys that were accessible on the compromised machine.
- Behavioral Monitoring: Implement endpoint detection mechanisms that monitor for anomalous process spawning, unauthorized network connections over DNS TXT queries, and reflective memory loading.
Securing the Development Pipeline for Tomorrow
To defend against future iterations of automated dropping campaigns, development teams and enterprise security architects must adopt advanced security practices:
- Move Beyond Static Blocklists: Security tooling must incorporate behavioral analysis, abstract syntax tree (AST) parsing, and similarity matching to catch malicious code modifications before they execute.
- Enforce Strict Dependency Pinning and Auditing: Utilize automated software composition analysis (SCA) tools that continuously monitor dependency trees for anomalous behaviors, unexpected binary inclusions, and suspicious network activity during build phases.
- Sandboxed Build Environments: Execute CI/CD pipelines and local package installations within ephemeral, heavily restricted sandboxes or containerized environments that prevent unauthorized network egress and restrict filesystem access.
- Scrutinize Transitive Dependencies: Security teams must audit not only direct dependencies but also transitive third-party packages, which are frequently the vector through which obscure, automated dropper components infiltrate enterprise applications.
Future Outlook
The Flooding Dropper campaign serves as a stark harbinger for the future of software supply chain security. As artificial intelligence and automation tools lower the barrier to entry for cybercriminals, the frequency, scale, and complexity of automated registry attacks will undoubtedly accelerate.
Defeating campaigns of this magnitude requires a coordinated industry response. Open-source registries, security vendors, and enterprise development teams must forge real-time intelligence-sharing partnerships, deploy advanced behavioral detection at the registry level, and fundamentally rethink how trust is established and verified in modern software development. Until the ecosystem transitions to a model of continuous, behavioral-driven verification, campaigns like Flooding Dropper will remain a potent and persistent threat to the global digital infrastructure.
Frequently Asked Questions (FAQ)
What is the Flooding Dropper campaign?
Flooding Dropper is an expansive, automated malicious npm campaign (tracked as sonatype-2026-005660) that distributes small numbers of harmful packages across hundreds of disposable "burner" accounts. This strategy overwhelms registry moderation queues and evades traditional signature-based detection mechanisms.
How does the malware infect a system?
The infection triggers automatically when an infected package is installed or imported into a project. An initial JavaScript loader checks the host operating system and architecture, downloads a multi-platform binary via HTTPS (with a fallback to DNS TXT records if blocked), and executes the payload as a detached background process to ensure persistence.
Why are traditional blocklists ineffective against this campaign?
The threat actors behind Flooding Dropper frequently alter package naming conventions (moving beyond initial terms like "bigops" and "bnpl") and make minor modifications to source code variable names and URLs. Because attackers can change names and signatures faster than defenders can update static blocklists, behavioral and similarity analysis are required to catch new variations.
What should an organization do if infected?
Organizations must assume the host is fully compromised, isolate the system, remove the malicious package, investigate secondary payloads and persistence mechanisms (such as Windows Registry Run keys and scheduled tasks), and thoroughly rotate all exposed credentials and API keys.
