Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware

# Four Malicious npm Packages Weaponize Open-Source Worm Code, Deliver Botnets and Infostealers to Developers

Cybersecurity researchers have uncovered four malicious npm packages distributed from a single account that deploy distinct attack payloads—including a DDoS botnet and credential-stealing malware—demonstrating how the recent open-sourcing of sophisticated worm code has accelerated supply chain threats targeting developers worldwide.

Published by the npm user deadcode09284814, the packages maintain deceptively legitimate names designed to evade detection: chalk-tempalte, @deadcode09284814/axios-util, axois-utils, and color-style-utils. Combined, they have been downloaded over 2,000 times as of May 18, 2026—and remain available on npm's public registry despite the security threat.

The discovery, made by security researchers at OX Security, reveals a sophisticated multi-vector attack campaign that exploits both the npm ecosystem's size and the recent weaponization of open-source malware code. Most concerning: one package contains an almost-unmodified clone of the Shai-Hulud worm, source code that was leaked by TeamPCP just days earlier, transforming public research into immediate threat delivery infrastructure.

## The Threat: Four Packages, Multiple Payloads

The four malicious packages employ different attack vectors despite originating from the same actor:

### Phantom Bot DDoS Malware (axois-utils)

The axois-utils package (963 downloads) installs a Golang-based distributed denial-of-service botnet called Phantom Bot. Once executed, the malware:

The payload transforms infected machines into botnet nodes capable of participating in coordinated attacks against external targets—making developer machines vectors for attacks on third-party infrastructure.

### Shai-Hulud Clone (chalk-tempalte)

The chalk-tempalte package (825 downloads) contains an almost verbatim copy of the Shai-Hulud worm released by TeamPCP, repurposed with the attacker's own command-and-control (C2) server and private cryptographic keys. The implementation demonstrates remarkable efficiency: the actor essentially copied functional exploit code and deployed it without substantial modification.

The chalk-tempalte stealer:

### Credential and System Stealers (@deadcode09284814/axios-util and color-style-utils)

The remaining two packages employ straightforward but effective information-stealing functionality:

| Package | Downloads | Exfiltrated Data | C2 Server |

|---------|-----------|------------------|-----------|

| @deadcode09284814/axios-util | 284 | SSH keys, environment variables, cloud credentials, system info, IP address, wallet data | 80.200.28.28:2222 |

| color-style-utils | 934 | SSH keys, environment variables, cloud credentials, system info, IP address, wallet data | edcf8b03c84634.lhr.life |

Each package targets the crown jewels of a developer's machine: authentication material, cloud access tokens, and cryptocurrency wallet information—data that can immediately enable account takeover and financial theft.

## Background and Context: When Open Source Becomes Ammunition

The discovery cannot be separated from a critical recent event: TeamPCP's decision to release the Shai-Hulud worm source code publicly just days before these packages appeared on npm. Shai-Hulud—a sophisticated, multiplatform information stealer previously deployed in targeted campaigns—became instantly available to any threat actor willing to search.

The timing is not coincidental. OX Security researchers noted that the actor was likely participating in what appears to be an underground supply chain attack competition promoted on BreachForums, the notorious hacking forum where major breach databases are traded. The competition may incentivize threat actors to weaponize the newly public code as quickly as possible, creating a race-to-exploit dynamic that accelerates malware development cycles.

This pattern reflects a troubling trend: open-source disclosure of offensive tools has become a double-edged sword. While security researchers argue that transparency enables defensive improvements, threat actors now have high-quality, battle-tested exploit code that requires minimal modification to repurpose for their own campaigns. The barrier to entry for complex supply chain attacks has never been lower.

## Why npm Remains a High-Value Target

The npm ecosystem's scale and trust model make it an ideal target for supply chain attacks:

The actor exploited this environment by creating plausibly named packages that would attract developers searching for legitimate libraries. The variation in payloads suggests either a multi-stage attack strategy (different packages for different victims) or a deliberate attempt to maximize the chances that some packages avoid detection.

## Implications: Developers as Targets and Vectors

The discovery carries implications across multiple layers of the development ecosystem:

For Individual Developers: Those who installed these packages have likely had credentials stolen, potentially including GitHub tokens, AWS keys, SSH keys, and other authentication material. This exposure is not merely a personal security problem—it becomes an organizational one if the developer used the same credentials across multiple systems or projects.

For Development Teams: Organizations employing developers who downloaded these packages face potential compromise of internal repositories, cloud infrastructure, and CI/CD pipelines. A single compromised developer machine can become the entry point for lateral movement across enterprise infrastructure.

For Downstream Consumers: If any of these packages were themselves dependencies of other open-source projects, the malware could propagate to secondary and tertiary consumers who have no direct connection to the original attacker.

For Cloud and SaaS Providers: The targeting of cloud credentials (AWS, Azure, GCP access keys) and cryptocurrency wallets suggests that attackers are using developer machines as beachheads for cloud infrastructure compromise and financial theft.

## Immediate Response and Remediation

Users and organizations must act urgently:

Immediate steps for affected users:

For organizations:

---

## HackWire Analysis

This incident represents a critical inflection point in the supply chain attack landscape. What distinguishes this campaign from earlier npm exploits is not the sophistication of the malware—the Shai-Hulud clone demonstrates that attackers no longer need to develop original code. Rather, it is the speed of weaponization and the explicit competition dynamic driving threat actors to move faster.

The creation of an underground competition for supply chain attacks on BreachForums is particularly concerning because it creates a financial incentive and reputational reward system for successful exploitation. This transforms supply chain security from a technical problem into an economic one: if threat actors can earn recognition and payment for compromised packages, they will invest the effort to find and exploit vulnerable ecosystems.

The multi-payload approach also suggests sophistication in targeting. Rather than blanket-distributing the same malware, the attacker deployed different payloads—a DDoS botnet, a worm clone, and two information stealers—which may indicate either that different packages were aimed at different victim profiles, or that the attacker is testing which payloads achieve maximum propagation. Either way, it reflects a mature understanding of attack surface optimization.

For developers and organizations, the lesson is stark: trust in open-source package names is no longer a viable security model. The speed of these attacks, the minimal barriers to publication, and the now-public availability of sophisticated malware code mean that supply chain compromise will only accelerate. The only defense is defensive: aggressive dependency management, regular credential rotation, and the assumption that any package could be malicious until proven otherwise.

The ecosystem needs systemic change—whether through mandatory code review, reputation systems with consequences for malicious packages, or more aggressive detection and removal mechanisms. Until those changes occur, developers should treat npm packages with the same caution they would apply to binaries downloaded from untrusted sources.

— HackWire Editorial

---

## Related Coverage