Sonatype Tracks 'Flooding Dropper' Campaign Flooding npm With 846 Malicious Packages Across Disposable Accounts
Sonatype is tracking sonatype-2026-005660, a campaign that has published 846 malicious npm packages across throwaway accounts, dropping cross-platform malware with DNS-based fallback delivery.
Overview
Sonatype Research Labs is tracking an active malicious-package campaign on npm, dubbed “Flooding Dropper,” that had implicated 846 software components at the time of publication, according to Sonatype. The campaign, which Sonatype tracks under the identifier sonatype-2026-005660, spreads by automating the creation of npm accounts and packages rather than relying on a single prolific publisher, according to Sonatype.
What We Know
The campaign came to light on August 5, 2026, when security researchers from OpenSourceMalware reported a malicious npm package named bigops-backend that delivered a platform-specific binary to Windows, Linux, and macOS systems, according to Sonatype. Sonatype Research Labs researcher Jorge Cardona then determined that the package was part of a much larger, ongoing operation, according to Sonatype.
Rather than publishing from one account, the operators behind Flooding Dropper generate many npm accounts with names that appear randomly generated and publish only a handful of packages from each one, according to Sonatype. Many of the package names interpolate terms such as “bigops” and “bnpl,” with examples including bigops-api and dolyame-boxy-desktop-bnpl-card-gallery, and many releases share version numbers beginning with 35.x.y, according to Sonatype. Sonatype notes the naming convention is already evolving beyond those two terms, and that both the naming patterns and the version-number correlation are useful for identifying today’s packages but are not durable detection mechanisms on their own, according to Sonatype.
The malicious code runs when a package is installed or imported and acts as a cross-platform first-stage loader, according to Sonatype. It checks environment variables and local state markers, identifies the host operating system and processor architecture, and attempts to download a matching binary from a randomized set of hardcoded remote hosts, according to Sonatype. If those direct downloads fail, the loader falls back to reconstructing the payload from DNS TXT-record responses, then writes the binary to a temporary directory, marks it executable on Unix-like systems, and launches it as a detached background process with its output suppressed, according to Sonatype. Because the payload runs as a separate detached process, killing the npm install or the parent Node.js process does not stop it, and blocking a single download host does not prevent delivery once the DNS fallback can reconstruct the payload, according to Sonatype.
Sonatype’s initial analysis of the downloaded Windows binary found it functions as a loader for a further payload, patching Event Tracing for Windows and the Antimalware Scan Interface to interfere with monitoring and scanning, checking for debuggers, virtual machines, sandboxes, and security products, and copying itself to a persistent location under the user’s AppData directory, according to Sonatype. It establishes persistence through both a Windows Registry Run key and a scheduled task, then downloads an encrypted payload from a remote /pkg/update_win.exe path, decrypts it, and executes it reflectively in memory rather than as a conventional file written to disk, a technique that makes it harder for disk-focused security tools to detect, according to Sonatype. Sonatype classifies the affected packages under CWE-506 with a CVSS score of 8.7, according to Sonatype.
Sonatype is urging organizations to determine whether any package tracked under sonatype-2026-005660 was downloaded or installed on developer workstations, CI/CD runners and build agents, internal repositories or caches, test systems, or production-adjacent infrastructure, and to treat any host where the packages ran as compromised rather than simply removing the dependency, according to Sonatype. Its recommended response includes isolating affected systems, reviewing process, DNS, proxy, and endpoint telemetry, removing persistence mechanisms, rebuilding affected systems where appropriate, and rotating npm, GitHub, cloud, and CI/CD credentials only after the environment has been cleaned, according to Sonatype.
The campaign lands against a backdrop in which npm dominates open-source malware volume. According to Sonatype’s Q2 2026 Open Source Malware Index, npm accounted for 96.6% of malicious package counts during the second quarter of 2026, and Sonatype Research had logged 1.8 million malicious packages across ecosystems by the end of that quarter.
Flooding Dropper is not the only npm supply-chain incident The Machine Herald has covered in recent days. On August 4, 2026, attackers took over the GitHub account of the maintainer behind the caching library keyv and used it to push a credential-stealing worm that spread to more than 1,300 npm package versions, as previously reported. That campaign, dubbed ChainDrop, relied on hijacking a single popular package’s release path; Flooding Dropper instead relies on volume, spreading malicious code through hundreds of newly created, low-profile accounts that each publish only a few packages, according to Sonatype.
What We Don’t Know
Sonatype’s write-up describes its findings as an initial analysis and says the campaign’s naming conventions, infrastructure, and payload details are still emerging, according to Sonatype. The identity of the threat actor behind Flooding Dropper, the number of downloads or installations the malicious packages have received, and the scope of any confirmed victim organizations have not been disclosed in Sonatype’s public reporting to date.
Analysis
Sonatype frames the campaign as an example of how automation is reshaping the economics of open-source malware distribution: attackers can generate accounts and publish slightly modified packages fast enough to frustrate defenses built around blocklists of known package or account names, according to Sonatype. Because no single account publishes more than a handful of packages, removing one prolific publisher does not eliminate the broader operation, and defenders are instead pushed toward behavioral and similarity analysis rather than name-based detection, according to Sonatype.