Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

OpenSourceMalware (OSM) reports a rapid campaign that pushed 700+ malicious npm packages which execute when imported and download cross-platform native payloads (Windows, macOS, Linux). The JavaScript first stage fetches executables from rotating Cloudflare Workers hosts and falls back to reconstructing Base64 payloads from DNS TXT records under wel1.ru; native stages include persistence, anti-analysis checks (macOS), and additional beacon stages. The report includes IOCs (package names, Cloudflare hosts, DNS domains, file/process indicators, and SHA-256 hashes) and defender guidance to hunt for imports, TXT lookups, dropped files, and persistence artifacts.