Leaked Shai-Hulud Source Code Fuels New npm Infostealer + DDoS Botnet Campaign (deadcode09284814, May 2026)

Leaked Shai-Hulud Source Code Fuels New npm Infostealer + (TL-2026-0528), also tracked as deadcode09284814 npm campaign, is a high-severity malware campaign, first published 2026-05-18. It has no confirmed attribution, affects npm Public npm registry, maps to 22 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-0528

Threat ID
TL-2026-0528
Also known as
deadcode09284814 npm campaign, Phantom Bot campaign, Shai-Hulud leaked-source variant, axois-utils DDoS botnet
Severity
HIGH
Status
MONITORING
Category
MALWARE
First published
2026-05-18
Last reviewed
2026-05-18
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, software-development, financial, cryptocurrency, cloud-services, open-source-ecosystem
Target regions
Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in Leaked Shai-Hulud Source Code Fuels New npm Infostealer +

Malware and tooling: Shai-Hulud, phantom bot, Node.js runtime

Threat actor account deadcode09284814 published four malicious npm packages over the weekend of May 16-17, 2026, leveraging the publicly leaked Shai-Hulud worm source code (originally attributed to TeamPCP). The packages typosquat the popular Axios HTTP client, exfiltrate developer credentials, cloud configs, and cryptocurrency wallet data to a localhost.run tunnel C2, and one package (axois-utils) introduces a persistent DDoS botnet dubbed 'phantom bot' with HTTP/TCP/UDP flood and TCP reset capabilities — marking the first known DDoS-capable variant in the Shai-Hulud derivative lineage.

How Leaked Shai-Hulud Source Code Fuels New npm Infostealer + works

On May 16-17, 2026, OXsecurity researchers identified four malicious npm packages published by the freshly-registered npm account deadcode09284814: chalk-tempalte, @deadcode09284814/axios-util, axois-utils, and color-style-utils. The campaign was disclosed publicly on May 18, 2026 by BleepingComputer.

The chalk-tempalte package contains an almost line-for-line unobfuscated clone of the original Shai-Hulud worm source code, which was leaked to GitHub the prior week (week of May 11, 2026) after the original TeamPCP infrastructure was burned. Unlike the original September 2025 Shai-Hulud worm — which used heavy webpack obfuscation and TruffleHog credential harvesting — this variant is plaintext JavaScript, allowing direct analysis of its behavior. The clone retains the original worm's credential exfiltration logic, public GitHub repository upload pattern (auto-generated repo names containing stolen secrets), and npm token theft routines, but does not appear to retain the self-propagating npm publish routine — suggesting the actor stripped propagation in favor of a fixed-target typosquatting campaign.

The @deadcode09284814/axios-util package, distributed under the actor's scoped namespace, focuses on credential and cloud configuration theft: AWS credential files (~/.aws/credentials), GCP service account JSONs, Azure CLI tokens, Docker config.json, npm authentication tokens (~/.npmrc), GitHub tokens, SSH private keys, and .env files. Stolen data is base64-encoded and exfiltrated to the C2 endpoint 87e0bbc636999b.lhr.life — a localhost.run reverse tunnel that resolves to ephemeral developer-grade infrastructure designed to evade reputation-based blocking.

The axois-utils package (typosquatting the legitimate axios package via character transposition) combines an infostealer payload with a novel persistent DDoS botnet component dubbed 'phantom bot' by the authors. After credential theft completes, the package installs a long-running Node.js process that periodically beacons to the same lhr.life C2 endpoint for attack commands. The botnet supports four attack primitives: high-rate HTTP GET/POST floods (targeting Layer 7 application endpoints), raw TCP connection floods (Layer 4 socket exhaustion), UDP packet floods (volumetric), and TCP RST injection attacks designed to terminate established connections on a target host. Beacon intervals are randomized between 30-90 seconds with jitter; commands are JSON-formatted and include target host, port, attack type, and duration parameters. This is the first observed DDoS capability in the Shai-Hulud lineage, representing a meaningful capability expansion of the leaked codebase.

The color-style-utils package is a lighter-weight infostealer targeting cryptocurrency wallet artifacts: MetaMask vault files (extension storage paths for Chrome/Brave/Edge), Exodus wallet seed.seco files, Electrum wallet directories, and clipboard contents matching cryptocurrency address regexes. It also collects external IP information via lookups to ipinfo.io and ipify.org for victim geolocation.

All four packages share a common installation hook via npm's preinstall and postinstall lifecycle scripts, executing payloads silently before the package's nominal functionality (or lack thereof) is exposed. The typosquatting strategy targets Axios — one of the most downloaded npm packages (over 50 million weekly downloads) — making install-time typo errors statistically inevitable across the developer ecosystem.

Attribution is distinct from TeamPCP (the original Shai-Hulud operators). The unobfuscated nature of the chalk-tempalte clone, the new typosquatting branding, the addition of DDoS capability not present in the original source, and the use of an off-the-shelf reverse tunnel (lhr.life) rather than dedicated C2 infrastructure all suggest an opportunistic individual or small group reusing the leaked source rather than a continuation of the original TeamPCP operation. Attribution confidence is LOW for any specific actor; HIGH that this is separate from TeamPCP.

All four packages were removed from npm following responsible disclosure, but the leaked Shai-Hulud source code remains publicly accessible on GitHub mirrors, making follow-on copycat campaigns near-certain in the coming weeks.

MITRE ATT&CK techniques used in TL-2026-0528

Collection

T1005 Data from Local System; T1115 Clipboard Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1195 Supply Chain Compromise

Impact

T1498 Network Denial of Service; T1499 Endpoint Denial of Service

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

Persistence

T1546 Event Triggered Execution

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities

Affected products and versions in Leaked Shai-Hulud Source Code Fuels New npm Infostealer +

  • npm — Public npm registry
    Vulnerable versions: chalk-tempalte (all); @deadcode09284814/axios-util (all); axois-utils (all); color-style-utils (all)
    Fixed in: All four packages removed from npm
  • Axios — axios npm package (typosquat target)
    Vulnerable versions: Indirect — any developer mistyping axios as axois or installing chalk-tempalte instead of chalk-template

Remediation for Leaked Shai-Hulud Source Code Fuels New npm Infostealer +

Patches

  • No vendor patch — affected packages were removed by npm after disclosure
  • Run npm audit and re-resolve lockfiles to drop transitive references

Immediate actions

  • Audit npm dependency trees for the four malicious packages: chalk-tempalte, @deadcode09284814/axios-util, axois-utils, color-style-utils
  • Search developer endpoints and CI runners for installation traces: ~/.npm/_logs, package-lock.json, yarn.lock entries
  • Rotate ALL credentials present on any host that installed these packages: AWS keys, GCP service accounts, Azure tokens, GitHub PATs, npm tokens, SSH keys, .env secrets
  • Block egress to *.lhr.life and the specific C2 host 87e0bbc636999b.lhr.life at perimeter and endpoint DNS
  • Search GitHub for auto-generated repositories under compromised user accounts and delete them
  • Hunt for Node.js processes performing outbound socket floods (indicator of phantom bot residence)

Workarounds

  • Use npm install --ignore-scripts for untrusted dependencies
  • Pin direct dependencies to known-good versions via exact-version locking

Longer-term hardening

  • Enforce npm package allowlists or signed lockfile verification in CI/CD pipelines
  • Deploy npm install-time scanners (Socket, Snyk, OXsecurity) in pre-commit and CI hooks
  • Disable npm preinstall/postinstall lifecycle scripts in CI builds via --ignore-scripts where feasible
  • Implement egress allowlisting on developer workstations and build agents to prevent exfiltration to ephemeral tunneling services
  • Adopt scoped private registry mirrors with package vetting (Verdaccio, JFrog Artifactory)
  • Train developers on Axios typosquat awareness (axios vs axois, chalk-template vs chalk-tempalte)

Weaknesses (CWE) in Leaked Shai-Hulud Source Code Fuels New npm Infostealer +

CWE-506, CWE-829, CWE-494, CWE-915

Timeline of Leaked Shai-Hulud Source Code Fuels New npm Infostealer +

  • Original Shai-Hulud npm worm campaign by TeamPCP disclosed, compromising hundreds of npm packages via stolen maintainer tokens
  • Shai-Hulud worm source code leaked on GitHub during the week of May 11, 2026, exposing the unobfuscated implementation
  • Threat actor account deadcode09284814 publishes first malicious package to npm registry, beginning the four-package campaign
  • axois-utils introduces 'phantom bot' DDoS botnet capability — first DDoS-capable variant in the Shai-Hulud lineage
  • Remaining three malicious packages (chalk-tempalte, axois-utils, color-style-utils, @deadcode09284814/axios-util) published over the weekend
  • npm removes the four malicious packages following responsible disclosure; deadcode09284814 account actioned
  • BleepingComputer publishes public disclosure article naming the campaign and IOCs
  • OXsecurity researchers publish technical analysis of the four malicious packages and the leaked-source provenance
  • As of 2026-05-29, the four deadcode09284814 packages were pulled from npm and the lhr.life tunnel C2 was ephemeral, but the leaked Shai-Hulud source remains public and is actively fueling copycat campaigns (SecurityAffairs, BleepingComputer, Field Effect). The reusable phantom-bot/infostealer tooling and concurrent Mini Shai-Hulud waves keep this a live, recurring supply-chain concern.

Sources cited for Leaked Shai-Hulud Source Code Fuels New npm Infostealer +

Threats related to Leaked Shai-Hulud Source Code Fuels New npm Infostealer +

Detection coverage for TL-2026-0528

As of 2026-05-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0528 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats