Leaked Shai-Hulud malware fuels new npm infostealer campaign

# Leaked Shai-Hulud Malware Deployed in New npm Attack Campaign—Four Packages Target Developers

Over the weekend, researchers at OXsecurity detected four malicious packages on the npm registry, all carrying variants of the Shai-Hulud infostealer that escaped into public hands just days earlier. The campaign, launched by an account using the handle deadcode09284814, represents the first documented weaponization of Shai-Hulud on npm—and it exposes a harsh reality about leaked malware: once the source code goes public, the barrier to entry for supply chain attacks collapses entirely.

## The Threat

Between May 17 and May 18, 2026, four malicious npm packages appeared on the registry, each engineered to steal developer credentials, API keys, cryptocurrency wallet data, and system configuration files. The packages used a mix of tactics to evade detection:

The Packages:

Combined, the four packages accumulated 2,678 downloads before removal—a relatively small footprint, but each installation represented a direct pathway to stolen credentials and potential lateral movement into victim organizations.

The most significant variant, axois-utils, stands apart for its DDoS capability. The package supports HTTP, TCP, and UDP flood attacks, as well as TCP reset operations, transforming compromised developer systems into nodes in a botnet infrastructure.

## Background and Context

Shai-Hulud did not emerge overnight. The malware lineage traces back to September 2025, when the TeamPCP hacker group began injecting the infostealer into legitimate npm packages and open-source projects. Over nine months, TeamPCP conducted multiple campaign iterations, each time harvesting developer credentials with publishing rights, then pivoting those stolen accounts to spread further malware.

The group's operational pattern was methodical: identify maintainers of popular packages, inject malware, steal their npm credentials, use those credentials to publish additional malicious versions, and exfiltrate stolen data to public GitHub repositories for retrieval. The strategy was effective enough that researchers began tracking it as a distinct supply-chain threat actor.

Then, on May 12, 2026, the source code for Shai-Hulud appeared on GitHub. A user claiming affiliation with TeamPCP posted the leak with a message: "Here We Go Again - Let the Carnage Continue. A Gift from TeamPCP." The motivation remains unclear—whether this was a deliberate escalation, a case of internal theft, or a taunting gesture. What mattered was the effect: the malware was now available to anyone.

Within six days, copycat threat actors were already deploying variants.

## Technical Details

The fresh npm campaign reveals both sophistication and sloppiness.

The Code:

The chalk-tempalte package contained what OXsecurity describes as "an almost exact copy of the leaked source code, with no obfuscation techniques." This is not refinement—it is lazy reuse. The threat actor did not bother to obfuscate variable names, strip comments, or implement evasion measures. The code was copied verbatim from the public leak.

This suggests the attacker (deadcode09284814) is either a junior operator experimenting with the leaked tool, or a threat actor prioritizing speed over stealth. Either way, it worked. The malware successfully exfiltrated data before the packages were identified.

Capabilities:

All four packages included information-stealing routines targeting:

The Shai-Hulud core retained its original GitHub publishing functionality, allowing stolen credentials to be uploaded to auto-generated public repositories, where the attacker could retrieve them after the malware execution window closed.

Command and Control:

Exfiltration traffic was routed to 87e0bbc636999b.lhr.life, a C2 infrastructure using a London-registered top-level domain. This is not sophisticated operational security; it is a direct, traceable link to the attacker. The choice suggests either operational inexperience or indifference to attribution.

## Implications

Who Is at Risk:

The primary victims are JavaScript developers and development teams using npm. However, the risk extends deeper:

The fact that only 2,678 downloads occurred is misleading. Each download represents a potential point of entry into a development environment—and development environments typically have elevated access to production systems, secrets management platforms, and deployment pipelines.

## Recommendations

For Developers:

1. Check your downloads: Review npm install logs and package-lock.json files to determine if any of the four malicious packages were installed

2. Revoke credentials immediately: If you use npm, rotate your npm authentication tokens, SSH keys, Git credentials, and any API keys that may have been stored in plaintext or environment files

3. Audit Git history: Check your Git repositories for unexpected commits or pushes

4. Monitor for unauthorized access: Review cloud provider audit logs (AWS CloudTrail, GCP Audit Logs, Azure Activity Log) for unexpected API calls or authentication attempts

5. Check your GitHub account: Look for unauthorized repository creation or public data uploads

For Security Teams:

1. Monitor for Shai-Hulud variants: Update YARA rules and malware signatures to detect this family and its derivatives

2. Scan development environments: Deploy endpoint detection tools to identify instances of the four malicious packages or lingering Shai-Hulud artifacts

3. Tighten npm registry controls: Consider using private npm registries, package signing verification, and automated scanning of dependency trees

4. Implement credential scanning: Use tools like git-secrets or TruffleHog to detect exposed credentials in repositories

---

## HackWire Analysis

The Leak Accelerates the Timeline

The nine-month Shai-Hulud campaign operated under the assumption that leaked source code was a remote possibility, not an inevitability. TeamPCP had a working malware platform, operational tradecraft, and a clear attack chain. That changed on May 12.

What's notable here is not just that code was leaked, but how quickly it was weaponized—and how *poorly*. The fact that a novice threat actor could copy-paste Shai-Hulud into npm packages with zero obfuscation and still achieve 2,678 downloads tells us something uncomfortable: the barrier to entry for software supply chain attacks is no longer technical sophistication. It is access to a GitHub account and npm publishing rights.

We've seen this pattern before. When Mirai source code leaked in 2016, copycat botnets flooded the internet within weeks. When Cobalt Strike beacons leaked, commodity ransomware groups started using them. Leaked malware doesn't age—it becomes *cheaper*. Threat actors who lacked the resources to develop their own infostealer can now grab Shai-Hulud and deploy it with minimal modification.

The pattern also reveals a gap in supply chain defense: npm's current scanning and vetting processes did not catch four distinct packages carrying identical malware signatures. Typosquatting detection caught one variant (chalk-tempalte mimics chalk), but the others (axois-utils, @deadcode09284814/axios-util, color-style-utils) relied on generic names that blend into the noise of legitimate utility packages. The registry's dependency analysis did not flag the sudden appearance of identical command-and-control patterns across four different maintainers.

This is a defenders' problem. Until registries implement mandatory malware scanning, cryptographic package signing at scale, or stricter identity verification for new publishers, the pattern will repeat: leak → commoditization → widespread deployment. And each iteration will catch defenders flat-footed, rotating credentials for another hundred or thousand developers who happened to install the wrong package on a Friday afternoon.

— HackWire Editorial

---

## Recommendations for Detection

Indicators of Compromise (IOCs):

| Type | Value |

|------|-------|

| C2 Domain | 87e0bbc636999b.lhr.life |

| npm Packages (Malicious) | chalk-tempalte, @deadcode09284814/axios-util, axois-utils, color-style-utils |

| File Indicators | .npmrc, .git-credentials, .ssh/id_* (in exfiltration telemetry) |

| Network Signature | HTTP/TCP traffic to 87e0bbc636999b.lhr.life |

---

## Related Coverage