Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware
Four malicious npm packages with more than 3,000 combined downloads have been confirmed as delivering information-stealing malware and a Golang DDoS botnet. OX Security confirms all four packages remained available for download at the time of disclosure.
A developer terminal screen showing an npm package installation with a red security warning overlay, representing the discovery of four malicious npm packages delivering infostealers and a DDoS botnet.
Four malicious packages discovered in the npm registry have been confirmed as delivering a combination of information-stealing malware and a Golang-based distributed denial-of-service botnet, with all four packages still available for download at the time of disclosure.
The packages are chalk-tempalte, @deadcode09284814/axios-util, axois-utils, and color-style-utils. All four were published by the same npm account under the username "deadcode09284814" and collectively accumulated more than 3,000 downloads before being identified by OX Security researchers.
This discovery sits within a broader pattern of supply chain attacks targeting developer ecosystems. As our analysis of developer workstations as software supply chain risks outlines, credentials and secrets stored on developer machines are now primary targets for threat actors operating at scale.
Phantom Bot: DDoS Across Protocols
The axois-utils package delivers Phantom Bot, a Golang-based DDoS botnet capable of flooding targets using HTTP, TCP, and UDP protocols simultaneously. Phantom Bot also establishes persistence on both Windows and Linux machines by adding its payload to the Windows Startup folder and creating a scheduled task.
Shai-Hulud Worm Clone
The chalk-tempalte package contains a near-identical clone of the Shai-Hulud worm source code open-sourced by the threat group TeamPCP. The actor uploaded a working version with its own command-and-control server and private key to npm with minimal modification.
Stolen credentials are exfiltrated to a remote C2 server and exported to a public GitHub repository given the description "A Mini Sha1-Hulud has Appeared." Incident response teams can use this string to search for related exposure across GitHub.
Credential and Key Harvesting
The @deadcode09284814/axios-util and color-style-utils packages siphon SSH keys, environment variables, cloud credentials, system information, IP addresses, and cryptocurrency wallet data to attacker-controlled infrastructure.
Immediate Response Steps
Uninstall the affected packages and delete any malicious configuration injected into IDEs and coding agents. Rotate all secrets that may have been present in the development environment. Search GitHub repositories for the string "A Mini Sha1-Hulud has Appeared." Block network access to command-and-control domains identified in the analysis.
The broader TeamPCP campaign has simultaneously expanded its reach to dozens of TanStack npm packages as well as packages tied to UiPath, Mistral AI, and OpenSearch. OX Security notes that the open-sourcing of the Shai-Hulud codebase is lowering the technical barrier for new actors and accelerating the pace of supply chain attacks.
For GCC technology organisations, CISA's software supply chain security guidance and the NCSC supply chain security framework provide practical controls for managing open source dependency risk. See also our earlier coverage of 36 malicious npm packages targeting Redis and PostgreSQL for additional supply chain context.
Omar Al-Hakeem
Senior Cyber Threat Analyst | MENA RegionOmar Al-Hakeem is a cybersecurity researcher specializing in threat intelligence, ransomware trends, and nation-state activity across the Middle East and North Africa. With over 12 years of experience in SOC operations and incident response, he provides deep technical breakdowns of emerging attacks and regional cyber risks. At MENA Cyber Wire, Omar focuses on real-world threat analysis and actionable defense strategies for enterprises and startups.