Leaked Shai-Hulud Malware Sparks New npm Infostealer Campaign
In May 2026, a threat actor using the alias 'deadcode09284814' published four malicious packages on the npm registry, embedding a non-obfuscated version of the Shai-Hulud malware. These packages targeted developer credentials, secrets, cryptocurrency wallet data, and account information. Notably, one package also transformed infected systems into bots for distributed denial-of-service (DDoS) attacks. The malicious packages included 'chalk-tempalte', '@deadcode09284814/axios-util', 'axois-utils', and 'color-style-utils'. Researchers at OXsecurity identified these uploads, highlighting the use of typosquatting techniques to deceive developers. The 'chalk-tempalte' package contained a direct clone of the Shai-Hulud malware, originally attributed to the TeamPCP hacker group, indicating that other actors are now leveraging the leaked source code. This incident underscores the persistent threat of supply chain attacks within the open-source ecosystem, emphasizing the need for developers to exercise caution when integrating third-party packages. The reuse of the Shai-Hulud malware by different threat actors highlights the rapid dissemination and adaptation of malicious tools, posing ongoing risks to software supply chains.
Kill Chain
