885 npm packages, one import-time loader: an August 2026 dependency confusion campaign

Summary

• 885 packages and 932 versions, published between 1 and 8 August 2026.
• Names copy internal-looking package families: 174 start with dolyame- and 64 with tinkoff-.
• Versions jump to 20.x and 35.x, higher than a private registry is likely to hold.
• The code runs when the package is imported. There is no install hook, so npm install --ignore-scripts does not stop it.
• It downloads a platform binary from Cloudflare Workers hosts or DNS TXT records, writes it to a temporary directory and starts it detached.
• 732 packages have LPM's own source review and 523 have an OpenSSF/OSV malicious-package advisory. Each package has at least one.

Timeline

The packages arrived in two waves. Most 20.x versions fetched their payload through dl.well1.site, and most 35.x versions through dl.wel1.ru. Both waves used the same five Cloudflare Workers hosts.

• 1 August. The first versions appeared with low and mid version numbers, from 5.x to 12.x.
• 2 August. About 200 packages were published at 20.x.
• 3–5 August. Versions moved to 34.x and 35.x. The largest burst came on 5 August: 580 packages at 35.x.
• 7–8 August. 79 more packages at 35.x, then publishing stopped.

What the names point at

Most names copy package families that look internal to one company, such as dolyame- (174), devplatform- (95), bnpl- (65), tinkoff- (64), bigops- (62) and checkout- (58). Dolyame is a buy-now-pay-later service from T-Bank, formerly Tinkoff, and two names start with tramvai-, the name of Tinkoff's open-source web framework.

That pattern fits dependency confusion: publishing public packages under the names of a company's private packages, with higher version numbers, so that a build which also checks the public registry installs the public copy. We have no evidence that T-Bank's systems or registries were compromised, and the names alone do not show who published the packages.

How the loader works

The reports for these packages describe the same chain:

1. The package's main entrypoint loads a helper file as soon as it is required. The helper has a generic name that changes between packages, such as _init.js, _compat.js or setup.js.
2. The helper picks a platform-specific endpoint and fetches a payload from one of the Workers hosts, or from DNS TXT records under dl.wel1.ru or dl.well1.site.
3. It writes the payload to /var/tmp/.cache_<random>, or to dotnet_diag_<random>.exe in the Windows temp directory, marks it executable and starts it detached through /bin/sh or cmd.exe.
4. A stamp file, /tmp/.analytics_state, limits how often it runs. Errors are suppressed, and the payload is not signed or hash-checked.

Because nothing runs at install time, the loader fires later, when an application, test run or build tool imports the package. Reports call this out as import-time remote code execution; see all npm packages with remote code execution.

Indicators of compromise

What to do

• Search lockfiles and node_modules for the package names below, especially at versions 20.x or 35.x that you did not publish.
• If one of these versions was installed and imported, treat that machine or build runner as compromised: isolate it, look for the files above, and rotate every credential it could reach.
• Block the hosts above at DNS and network egress.
• Publish internal packages under an npm scope you own, and map that scope to your private registry in .npmrc, for example @your-scope:registry=https://registry.example.com/.
• Do not let a private registry proxy fall back to the public registry for unscoped internal names, and install from lockfiles with integrity hashes.
• --ignore-scripts does not help against this loader, because it runs on import.

Affected packages

885 packages in 82 name families. Each name links to its LPM Firewall report.

How we identified the packages

We started from the 35.x versions in LPM's reviewed reports, then checked the report evidence and advisory data of every npm block published between 25 July and 20 August 2026. A package is listed when its evidence references one of the Workers hosts or DNS hosts above. A further 22 versions in the same families show the file indicators but not the hosts, and are not listed. The list is a snapshot from Oct 23, 2026.

Read how LPM Firewall reports are produced, or browse more research.