Malicious npm Packages Steal SSH Keys, Cloud Credentials, Crypto Wallets

Key Takeaways

• Four malicious npm packages were discovered, designed to steal SSH keys, cloud credentials, cryptocurrency wallets, and environment variables.
• One package also incorporates a DDoS botnet capability, turning infected machines into attack vectors.
• The campaign utilizes typosquatting, primarily targeting users of the Axios library.
• The most notable package, chalk-template, is a direct clone of the recently leaked Shai-Hulud infostealer.
• Users who installed these packages must immediately uninstall them, rotate credentials, and check for indicators of compromise.

Malicious npm Packages Impersonate Popular Libraries, Steal Sensitive Data

Cybersecurity researchers have identified a coordinated campaign involving four malicious npm packages engineered to exfiltrate highly sensitive data, including SSH keys, cloud service credentials, and cryptocurrency wallet information. One variant further extends its capabilities by transforming compromised systems into nodes within a distributed denial-of-service (DDoS) botnet.

The operation appears to stem from a single threat actor leveraging a sophisticated typosquatting strategy. The primary target for this deceptive tactic is users of the widely adopted Axios JavaScript library, a move designed to maximize potential victim reach.

The packages—chalk-template, @deadcode09284814/axios-util, axios-utils, and color-style-utils—were detected within the past 24 hours. All versions of these packages are confirmed to be malicious. Before their identification and flagging, these illicit packages collectively garnered approximately 2,678 weekly downloads, indicating a significant risk exposure.

Shai-Hulud Infostealer Replicated and Deployed

Of particular concern is the package named chalk-template, which contains a nearly identical replication of the Shai-Hulud infostealer. The source code for Shai-Hulud, an open-source malware, was recently made public on GitHub by a group identified as TeamPCP just last week.

The threat actor behind chalk-template copied the Shai-Hulud code with minimal alterations, integrating their own command-and-control (C2) server address (87e0bbc636999b[.]lhr[.]life) and private key before uploading the functional package directly to the npm registry.

The lack of obfuscation in this deployment, a distinct characteristic compared to previous Shai-Hulud operations, suggests that this is a copycat actor rather than TeamPCP itself. Researchers at OX Security noted that this attack aligns with a supply chain attack competition advertised on BreachForums shortly after TeamPCP’s code leak. This indicates that the public availability of Shai-Hulud’s source code is actively inspiring new malicious campaigns.

Compromised machines using chalk-template upload stolen credentials to a new GitHub repository, a behavior that mirrors the original Shai-Hulud malware’s exfiltration method.

Diverse Attack Objectives Across Four Packages

Each of the four malicious npm packages is designed with a distinct set of attack objectives:

• chalk-template: This package functions as a Shai-Hulud clone, designed to exfiltrate credentials, cryptocurrency wallets, various secrets, and account information to a remote C2 server.
• @deadcode09284814/axios-util: A straightforward infostealer, this variant focuses on collecting SSH keys, environment variables, and cloud credentials from major providers such as AWS, GCP, and Azure. The collected data is then transmitted to 80[.]200[.]28[.]28:2222.
• axios-utils: This package deploys a GoLang-based “Phantom Bot” that establishes persistence, ensuring its survival even if the package is deleted. Furthermore, it includes a DDoS botnet module capable of launching various types of attacks, including HTTP, TCP, UDP, and reset flood requests against specified targets.
• color-style-utils: An unobfuscated infostealer, this package harvests IP addresses, geolocation data, and cryptocurrency wallet information, exfiltrating the data to edcf8b03c84634[.]lhr[.]life.

Indicators of Compromise (IOCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

This campaign underscores a concerning trend in the cybersecurity landscape: the increasing accessibility of sophisticated malware. With the Shai-Hulud source code now publicly available, the barrier to entry for launching potent supply chain attacks has significantly lowered.

OX Security cautions that this initial wave of attacks is likely just the beginning. The proliferation of “vibe-coded” malware across platforms like npm is expected to continue, with various iterations designed to harvest different data types for diverse criminal objectives—ranging from credential theft and crypto-draining to full-scale botnet recruitment, all potentially managed from a single malicious npm account.

What You Should Do

Anyone who has installed any version of the mentioned malicious packages should take immediate action:

• Uninstall Malicious Packages: Immediately remove chalk-template, @deadcode09284814/axios-util, axios-utils, and color-style-utils from all affected systems.
• Remove Malicious Configurations: Delete any associated malicious configurations or files from Integrated Development Environments (IDEs) and coding agents, including tools like Claude Code.
• Rotate Credentials: Promptly rotate all credentials and keys (e.g., SSH keys, cloud API keys, access tokens) on any machine where these packages were installed.
• Check for IoCs: Search GitHub repositories for the string “A Mini Sha1-Hulud has Appeared” as a potential indicator of compromise.
• Block Network Access: Implement network blocks for all listed C2 domains and IP addresses to prevent further communication with the threat actor.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.