# Leaked Shai-Hulud Source Code Fuels New npm Infostealer + DDoS Botnet Campaign (deadcode09284814, May 2026)

> Threat actor account deadcode09284814 published four malicious npm packages over the weekend of May 16-17, 2026, leveraging the publicly leaked Shai-Hulud worm source code (originally attributed to TeamPCP). The packages typosquat the popular Axios HTTP client, exfiltrate developer credentials, cloud configs, and cryptocurrency wallet data to a localhost.run tunnel C2, and one package (axois-utils) introduces a persistent DDoS botnet dubbed 'phantom bot' with HTTP/TCP/UDP flood and TCP reset capabilities — marking the first known DDoS-capable variant in the Shai-Hulud derivative lineage.

- **Published:** 2026-05-18T12:00:00Z
- **Last reviewed:** 2026-05-18T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0528
- **ID:** TL-2026-0528
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On May 16-17, 2026, OXsecurity researchers identified four malicious npm packages published by the freshly-registered npm account deadcode09284814: chalk-tempalte, @deadcode09284814/axios-util, axois-utils, and color-style-utils. The campaign was disclosed publicly on May 18, 2026 by BleepingComputer.

The chalk-tempalte package contains an almost line-for-line unobfuscated clone of the original Shai-Hulud worm source code, which was leaked to GitHub the prior week (week of May 11, 2026) after the original TeamPCP infrastructure was burned. Unlike the original September 2025 Shai-Hulud worm — which used heavy webpack obfuscation and TruffleHog credential harvesting — this variant is plaintext JavaScript, allowing direct analysis of its behavior. The clone retains the original worm's credential exfiltration logic, public GitHub repository upload pattern (auto-generated repo names containing stolen secrets), and npm token theft routines, but does not appear to retain the self-propagating npm publish routine — suggesting the actor stripped propagation in favor of a fixed-target typosquatting campaign.

The @deadcode09284814/axios-util package, distributed under the actor's scoped namespace, focuses on credential and cloud configuration theft: AWS credential files (~/.aws/credentials), GCP service account JSONs, Azure CLI tokens, Docker config.json, npm authentication tokens (~/.npmrc), GitHub tokens, SSH private keys, and .env files. Stolen data is base64-encoded and exfiltrated to the C2 endpoint 87e0bbc636999b.lhr.life — a localhost.run reverse tunnel that resolves to ephemeral developer-grade infrastructure designed to evade reputation-based blocking.

The axois-utils package (typosquatting the legitimate axios package via character transposition) combines an infostealer payload with a novel persistent DDoS botnet component dubbed 'phantom bot' by the authors. After credential theft completes, the package installs a long-running Node.js process that periodically beacons to the same lhr.life C2 endpoint for attack commands. The botnet supports four attack primitives: high-rate HTTP GET/POST floods (targeting Layer 7 application endpoints), raw TCP connection floods (Layer 4 socket exhaustion), UDP packet floods (volumetric), and TCP RST injection attacks designed to terminate established connections on a target host. Beacon intervals are randomized between 30-90 seconds with jitter; commands are JSON-formatted and include target host, port, attack type, and duration parameters. This is the first observed DDoS capability in the Shai-Hulud lineage, representing a meaningful capability expansion of the leaked codebase.

The color-style-utils package is a lighter-weight infostealer targeting cryptocurrency wallet artifacts: MetaMask vault files (extension storage paths for Chrome/Brave/Edge), Exodus wallet seed.seco files, Electrum wallet directories, and clipboard contents matching cryptocurrency address regexes. It also collects external IP information via lookups to ipinfo.io and ipify.org for victim geolocation.

All four packages share a common installation hook via npm's preinstall and postinstall lifecycle scripts, executing payloads silently before the package's nominal functionality (or lack thereof) is exposed. The typosquatting strategy targets Axios — one of the most downloaded npm packages (over 50 million weekly downloads) — making install-time typo errors statistically inevitable across the developer ecosystem.

Attribution is distinct from TeamPCP (the original Shai-Hulud operators). The unobfuscated nature of the chalk-tempalte clone, the new typosquatting branding, the addition of DDoS capability not present in the original source, and the use of an off-the-shelf reverse tunnel (lhr.life) rather than dedicated C2 infrastructure all suggest an opportunistic individual or small group reusing the leaked source rather than a continuation of the original TeamPCP operation. Attribution confidence is LOW for any specific actor; HIGH that this is separate from TeamPCP.

All four packages were removed from npm following responsible disclosure, but the leaked Shai-Hulud source code remains publicly accessible on GitHub mirrors, making follow-on copycat campaigns near-certain in the coming weeks.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1071 Application Layer Protocol
- T1090 Proxy
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1498 Network Denial of Service
- T1499 Endpoint Denial of Service

## Sources

- [Leaked Shai-Hulud malware fuels new npm infostealer campaign](https://www.bleepingcomputer.com/news/security/leaked-shai-hulud-malware-fuels-new-npm-infostealer-campaign/)
- [OXsecurity research disclosure on deadcode09284814 packages](https://www.ox.security/blog/)
- [Original Shai-Hulud worm analysis (September 2025)](https://www.bleepingcomputer.com/news/security/shai-hulud-worm-compromises-hundreds-of-npm-packages/)
- [npm advisory: malicious packages removed](https://www.npmjs.com/advisories)
- [CWE-506: Embedded Malicious Code](https://cwe.mitre.org/data/definitions/506.html)
- [MITRE ATT&CK T1195.002 Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0528