The open-source ecosystem has become a dangerous minefield for developers. A fierce new typosquatting campaign is actively hunting software engineers, threatening to hijack cloud environments, drain cryptocurrency wallets, and turn infected machines into a massive DDoS botnet.
This escalating threat highlights a chilling reality: attackers are weaponizing open-source malware faster than ever.
Over the past 24 hours, security researchers discovered four new malicious npm packages loaded with powerful infostealer code.
According to a recent report by OX Security, this campaign appears to be a direct result of a supply chain attack competition recently hosted on the notorious BreachForums.
All four packages are associated with a single npm user account. Yet, they deploy completely different tactics to harvest sensitive developer data.
npm Packages Steal Credentials
The campaign relies heavily on typosquatting, tricking developers who make minor spelling mistakes when downloading popular utilities like Axios.
OX Security noted that one package, named chalk-template, is a direct clone of the Shai-Hulud malware. TeamPCP leaked this specific malware source code on GitHub just last week.
Interestingly, the attacker used an exact copy with zero obfuscation, proving this is a completely different threat actor looking for a quick strike using publicly available tools.
Another package, @deadcode09284814/axios-util, acts as a highly effective information stealer.
It aggressively collects SSH keys, environment variables, and cloud credentials for AWS, GCP, and Azure. Meanwhile, the axois-utils package is far more destructive and persistent.
It drops a GoLang payload called a “phantom bot” that keeps running on the victim’s machine even after the npm package is deleted. This bot can launch severe DDoS attacks, flooding target websites with HTTP, TCP, UDP, and Reset requests.
Finally, the color-style-utils package operates as a classic infostealer with no attempt to hide its tracks.
It actively targets cryptocurrency wallets while collecting the victim’s IP geolocation data.
The sheer variety of data stolen across these four packages indicates a highly motivated attacker testing multiple infection methods simultaneously.
Anyone who has installed any version of these malicious packages is completely compromised.
The combined weekly download count for these packages has already reached 2,678, putting thousands of developers at serious risk.
The open-source release of the Shai-Hulud code has drastically lowered the barrier to entry, meaning a larger wave of similar supply chain attacks is likely on the horizon.
According to OX Security research, uninstall the malicious npm packages from your system. You should also hunt down and delete any related malicious configurations hidden inside your IDEs or AI coding agents, such as Claude Code.
Indicators of Compromise (IOCs)
| Indicator | Type |
|---|---|
87e0bbc636999b[.]lhr[.]life | Malicious C2 Domain |
b94b6bcfa27554[.]lhr[.]life | Malicious C2 Domain |
edcf8b03c84634[.]lhr[.]life | Malicious C2 Domain |
80[.]200[.]28[.]28:2222 | Malicious IP Address / Port |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
