Leaked Shai-Hulud Source Code Fuels New npm Infostealer + DDoS Botnet Campaign (deadcode09284814, May 2026) — Threadlinqs Intelligence
As of 2026-05-30, Leaked Shai-Hulud Source Code Fuels New npm Infostealer + DDoS Botnet Campaign (deadcode09284814, May 2026) is a high-severity malware threat attributed to deadcode09284814, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0528 · Severity: HIGH · Status: MONITORING · Category: MALWARE
Attribution: deadcode09284814 · FINANCIAL
Threat actor account deadcode09284814 published four malicious npm packages over the weekend of May 16-17, 2026, leveraging the publicly leaked Shai-Hulud worm source code (originally attributed to
On May 16-17, 2026, OXsecurity researchers identified four malicious npm packages published by the freshly-registered npm account deadcode09284814: chalk-tempalte, @deadcode09284814/axios-util, axois-utils, and color-style-utils. The campaign was disclosed publicly on May 18, 2026 by BleepingComputer.
The chalk-tempalte package contains an almost line-for-line unobfuscated clone of the original Shai-Hulud worm source code, which was leaked to GitHub the prior week (week of May 11, 2026) after the original TeamPCP infrastructure was burned. Unlike the original September 2025 Shai-Hulud worm — which used heavy webpack obfuscation and TruffleHog credential harvesting — this variant is plaintext JavaScript, allowing direct analysis of its behavior. The clone retains the original worm's credential exfiltration logic, public GitHub repository upload pattern (auto-generated repo names containing stolen secrets), and npm token theft routines, but does not appear to retain the self-propagating npm publish routine — suggesting the actor stripped propagation in favor of a fixed-target typosquatting campaign.
The @deadcode09284814/axios-util package, distributed under the actor's scoped namespace, focuses on credential and cloud configuration theft: AWS credential files (~/.aws/credentials), GCP service account JSONs, Azure CLI tokens, Docker config.json, npm authentication tokens (~/.npmrc), GitHub tokens, SSH private keys, and .env files. Stolen data is base64-encoded and exfiltrated to the C2 endpoint 87e0bbc636999b.lhr.life — a localhost.run reverse tunnel that resolves to ephemeral developer-grade infrastructure designed to evade reputation-based blocking.
The axois-utils package (typosquatting the legitimate axios package via character transposition) combines an infostealer payload with a novel persistent DDoS botnet component dubbed 'phantom bot' by the authors. After credential theft completes, the package installs a long-running Node.js process that periodically beacons to the same lhr.life C2 endpoint for attack commands. The botnet supports four attack primitives: high-rate HTTP GET/POST floods (targeting Layer 7 application endpoints), raw TCP connection floods (Layer 4 socket exhaustion), UDP packet floods (volumetric), and TCP RST injection attacks designed to terminate established connections on a target host. Beacon intervals are randomized between 30-90 seconds with jitter; commands are JSON-formatted and include target host, port, attack type, and duration parameters. This is the first observed DDoS capability in the Shai-Hulud lineage, representing a meaningful capability expansion of the leaked codebase.
The color-style-utils package is a lighter-weight infostealer targeting cryptocurrency wallet artifacts: MetaMask vault files (extension storage paths for Chrome/Brave/Edge), Exodus wallet seed.seco files, Electrum wallet directories, and clipboard contents matching cryptocurrency address regexes. It also collects external IP information via lookups to ipinfo.io and ipify.org for victim geolocation.
All four packages share a common installation hook via npm's preinstall and postinstall lifecycle scripts, executing payloads silently before the package's nominal functionality (or lack thereof) is exposed. The typosquatting strategy targets Axios — one of the most downloaded npm packages (over 50 million weekly downloads) — making install-time typo errors statistically inevitable across the developer ecosystem.
Attribution is distinct from TeamPCP (the original Shai-Hulud operators). The unobfuscated nature of the chalk-tempalte clone, the new typosquatting branding, the addition of DDoS capability not present in the original source, and the use of an off-the-shelf reverse tunnel (lhr.life) rather than dedicated C2 infrastructure all suggest an opportunistic individual or small group reusing the leaked source rather than a continuation of the original TeamPCP operation. Attribution confidence is LOW for any specific
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-915
Target sectors: technology, software-development, financial, cryptocurrency, cloud-services, open-source-ecosystem
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1587, T1588, T1195, T1059, T1204, T1546, T1036, T1027, T1552