A new supply chain attack campaign targeting developers has surfaced in the npm ecosystem, with four malicious packages discovered stealing sensitive data, including SSH keys, cloud credentials, and cryptocurrency wallets.
The campaign, identified by OX Security within the past 24 hours, highlights the growing risk posed by typosquatting attacks and reused open-source malware.
The malicious packages @deadcode09284814/axios-util, axois-utils, chalk-tempalte, and color-style-utils were published under a single npm account and collectively recorded over 2,600 weekly downloads.
Researchers warn that any installation of these packages results in immediate compromise, as all available versions contain embedded infostealer functionality.
One of the most notable findings involves the package chalk-tempalte, which contains a near-identical clone of the Shai-Hulud malware.
This malware strain was leaked publicly just days earlier by TeamPCP, making it quickly accessible to other threat actors.
According to OX Security said in a report shared with GBhackers, the attacker behind chalk-tempalte appears to have copied the leaked source code with minimal or no modification, including leaving the structure unobfuscated.
This lack of obfuscation distinguishes the campaign from the original developers and suggests opportunistic reuse rather than sophisticated development.
The cloned Shai-Hulud variant functions as an advanced infostealer, extracting sensitive information such as credentials, crypto wallets, and environment variables.
It transmits the stolen data to a command-and-control server hosted at 87e0bbc636999b.lhr.life and also mirrors previous behavior by uploading collected data to attacker-controlled GitHub repositories.
Embedded public keys and identical logic flows further confirm its direct lineage from the leaked source code.
The other malicious packages demonstrate varying capabilities, indicating a multi-functional attack strategy.
The @deadcode09284814/axios-util package focuses on harvesting SSH keys, environment variables, and cloud credentials across AWS, Google Cloud, and Azure environments.
It sends the collected data to a remote server at 80.200.28.28 over port 2222, suggesting a straightforward but effective data exfiltration method.
Meanwhile, axois-utils introduces a more aggressive payload by deploying what the attacker calls a “phantom bot.” This component establishes persistence on infected systems, ensuring continued operation of npm package is removed.
Written partially in Go, the bot transforms compromised machines into nodes within a DDoS botnet capable of launching HTTP, TCP, UDP, and reset-based flooding attacks. This marks a shift from pure data theft to active exploitation of infected infrastructure.
The fourth package, color-style-utils, operates as a simpler infostealer without advanced evasion techniques.
It collects system information such as IP address and geolocation data, along with cryptocurrency wallet details, and transmits them to another attacker-controlled domain, edcf8b03c84634.lhr.life.
Despite its simplicity, the lack of obfuscation suggests the attacker prioritized speed of deployment over stealth.
Researchers note that the campaign likely relies on typosquatting techniques, particularly targeting developers searching for popular packages like Axios.
The slight misspellings in package names increase the likelihood of accidental installation, especially in fast-paced development environments.
Developers who have installed any of these packages are strongly advised to uninstall them immediately, rotate all potentially exposed credentials, and inspect systems for lingering persistence mechanisms.
Additionally, scanning repositories for indicators such as the string “A Mini Sha1-Hulud has Appeared” may help identify compromised environments.
This incident underscores how quickly leaked malware can be weaponized in real-world attacks, amplifying the threat landscape and reinforcing the need for stricter dependency verification practices within the software supply chain.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…