‘Flooding Dropper’ Is Hitting npm With a Tidal Wave of Malicious Packages

Threat researchers from Sonatype are sounding the alarm on an escalating campaign dubbed "Flooding Dropper," which has inundated the npm platform with a deluge of malicious packages. The campaign, which has affected nearly 850 software components, utilizes a package naming convention that initially featured terms like "bigops" and "bnpl," such as "bigops-api" and "dolyame-boxy-desktop-bnpl-card-gallery."

However, as the campaign evolves, researchers have observed the emergence of packages with other naming conventions. The researchers emphasize that the campaign underscores the growing trend of threat actors utilizing open-source malware in distributed and automated campaigns to overwhelm registry moderation and blocklists.

Sonatype's threat researchers pointed out that publishing malicious packages at scale is not a new tactic, but distributing them across numerous disposable accounts makes containing the threat more challenging. The attackers employ randomly generated account names and publish only a few packages per account, preventing defenders from assuming that removing a prolific publisher will eliminate the broader operation.

This tactic places additional pressure on npm, as each account and package may require independent identification, review, and removal while the attacker continues generating new content.

For npm, the Flooding Dropper campaign exacerbates the moderation problem, as each account and package may need to be individually identified, reviewed, and removed while the attacker persists in creating more content. This places greater pressure on the code repository, which Sonatype noted accounted for 96.6% of malicious package counts during Q2 2026 according to their Open Source Malware Index. Over the past decade, Sonatype has documented over 1.8 million malicious packages across various ecosystems.

Security researchers at OpenSourceMalware, a community-driven threat intelligence platform and database, recently reported on a malicious npm package named "bigops-backend," which delivered a binary compatible with Windows, Linux, and macOS systems. However, Sonatype's team later found that the package was part of a larger campaign.

The evolving naming pattern and slightly modified payloads make detection more difficult, as they can reduce the effectiveness of detections relying on exact signatures, even if the underlying behavior remains closely related.

The first stage of the attack involves a JavaScript-based cross-platform loader with various delivery paths. The loader checks the environment to determine which operating system and processor to target before selecting the corresponding Windows, Linux, or macOS payload. It then attempts to download the binary from a set of remote hosts, falling back to DNS TXT records if direct HTTPS downloads fail.

The binary is written to a temporary directory on Unix-like systems and launched as a detached background process, ensuring it continues running independently even if the npm installation or parent Node.js process is stopped.

In the second stage, the Windows binary serves as a loader for another payload that searches for capabilities capable of interfering with monitoring and scanning. It checks for virtual machines, sandboxes, and security tools, copies itself to a persistent location within the user's AppData directory, and establishes persistence via Registry Run keys and scheduled tasks.

Additionally, it downloads and decrypts an encrypted payload, executing it in memory through reflective loading. This reflective loading technique allows the malware to execute without writing a conventional executable to disk, making it more challenging for disk-focused controls to detect.

Sonatype warns developers not to solely rely on specific naming conventions like "bigops" and "bnpl" as indicators of threats associated with the Flooding Dropper campaign. The attackers can easily change names, making it essential to implement behavioral and similarity analysis to identify variations. To mitigate the threat, organizations should assume that their host may be compromised, remove the infected packages, investigate secondary payload execution and persistence, and rotate exposed credentials after the environment has been cleaned.