Malicious npm Package Installation (Shai-Hulud Clones and Phantom Bot)

Ethan Andrews@eandrews

•updated May 27, 2026•9•0•130

Detects process executions or command-line arguments referencing the installation of identified malicious npm packages, specifically 'chalk-tempalte', '@deadcode09284814/axios-util', 'axois-utils', and 'color-style-utils'. These packages are associated with 'Shai-Hulud clones' and 'Phantom Bot' campaigns, often involving typosquatting or similar deceptive naming conventions to trick developers into installing malicious dependencies.