Flooding Dropper Hits npm With 850 Malicious Packages

Sicherheitsmeldung mit Schweregrad hoch (CVSS 8.7). Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

TL;DR Sonatype Research Labs is tracking an active malicious package campaign, dubbed 'Flooding Dropper,' spreading on npm, currently impacting 846 software components. The attacker appears to be automating parts of the npm account and package creation process, combining terms such as bigops and bnpl with other words and recurring version patterns, such as releases in the 35.x.y range. When installed, the packages download and execute a second-stage payload, using multiple delivery methods to improve the attack's chances of success. Sonatype is tracking this campaign as sonatype-2026-005660. Impacted organizations should consider the host compromised, remove the package, investigate secondary payload execution and persistence, and rotate exposed credentials only after the environment has been cleaned. On August 5, 2026, security researchers from OpenSourceMalware reported a malicious npm package named bigops-backend that delivered a platform-specific binary to Windows, Linux, and macOS systems. Sonatype Research Labs' Jorge Cardona observed this package is part of a much larger, ongoing campaign. At the time of publication, Sonatype has identified 846 software components implicated in the campaign, dubbed 'Flooding Dropper.' Rather than relying on a single publisher, the campaign generates npm accounts and publishes small numbers of packages from each one. Many package names interpolate terms such as bigops and bnpl, including examples resembling: bigops-api dolyame-boxy-desktop-bnpl-card-gallery The packages also contain slightly modified payloads. …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://www.sonatype.com/blog/flooding-dropper-hits-npm-with-850-malicious-packages
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.
• Erkennung: Logs und Indikatoren (IoCs) auf Ausnutzung prüfen.