Leaked Shai-Hulud malware fuels new npm infostealer marketing campaign

The Shai-Hulud malware leaked ultimate week is now utilized in new assaults at the Node Bundle Supervisor (npm) index, as inflamed applications emerged over the weekend.

A danger actor the usage of the account deadcode09284814 revealed 4 malicious applications on npm and embedded one in all them with a non-obfuscated model of Shai-Hulud that focused developer credentials, secrets and techniques, cryptocurrency pockets information, and account news.

All rogue applications integrated routines that exfiltrated news, reminiscent of credentials and configuration information, however one additionally grew to become the gadget right into a bot for disbursed denial-of-service (DDoS) job.

Researchers at OXsecurity, an organization that secures programs from code to runtime, found out the malicious uploads over the weekend and spotted that the danger actor used misspelled names (typosquatting) focused on Axios customers, and a few generic ones:

1. chalk-tempalte – Shai-Hulud clone (news stealer)
2. @deadcode09284814/axios-util – Credential and cloud config stealer
3. axois-utils – Infostealer + power DDoS botnet (“phantom bot”)
4. color-style-utils – Fundamental infostealer focused on crypto wallets and IP data

In keeping with the researchers, the chalk-tempalte bundle comprises a clone of the Shai-Hulud malware attributed to the TeamPCP hacker staff this is reponsible for the hot Mini Shai-Hulud device supply-chain assault.

The malware emerged on GitHub ultimate week, with a message allegedly from TeamPCP announcing “Right here We Cross Once more – Let the Carnage Proceed. A Present from TeamPCP.”

The chalk-tempalte bundle seems to be the primary documented case of a Shai-Hulud clone deployed on npm, despite the fact that Ox notes that it’s now not a complicated instance, however relatively an unmodified reproduction of the leaked supply code with none coverage.

“One incriminating proof that it is a other actor from TeamPCP, is that the Shai-Hulud malware code is a nearly actual reproduction of the leaked supply code, with out a obfuscation tactics, which make the overall model visually other from the unique,” OXsecurity explains.

The malware steals credentials, secrets and techniques, crypto pockets information, and account news and exfiltrates it to a command-and-control (C2) server at 87e0bbc636999b[.]lhr[.]lifestyles.

The code keeps the GitHub publishing capability, so it uploads stolen credentials to public, auto-generated repositories.

Of the opposite 3 applications, ‘axois-utils’ sticks out for together with DDoS capacity, along with the information-stealing capability provide throughout all 4 applications.

The bundle helps HTTP, TCP, and UDP floods, in addition to TCP reset assaults, whilst the researchers have additionally discovered inner references to a “phantom bot.”

The Shai-Hulud marketing campaign had more than one iterations since September 2025, stealing builders’ information by way of injecting malware into legit initiatives. After stealing credentials for accounts with publishing rights, the exfiltrated news used to be uncovered in public GitHub repositories. The campaigns have been attributed to the TeamPCP hacker staff.

In a prior document, OXsecurity says that danger actors briefly copied the malware supply code and began enhancing it to increase its functions.

The researchers counsel that builders who downloaded inflamed npm applications take away them straight away and rotate their credentials and API keys on affected programs.

OXsecurity notes that the 4 applications had a mixed obtain depend of two,678.