Executive Summary
A recent campaign involves the upload of four malicious npm packages by a threat actor identified as 'deadcode09284814'. These packages leverage the recently leaked Shai-Hulud malware source code and a new Go-based DDoS botnet dubbed 'Phantom Bot'. The campaign primarily uses typosquatting of popular libraries like Axios and Chalk to infect developer environments.
Technical analysis reveals a diverse set of capabilities including the exfiltration of SSH keys, environment variables, cloud credentials (AWS, GCP, Azure), and cryptocurrency wallets. Some variants specifically target IDE configurations and coding agents like Claude Code. This activity highlights a growing trend of 'copycat' actors utilizing leaked or open-source malware frameworks to conduct low-effort, high-impact supply chain attacks.
The urgency is high for organizations using npm, as the malware establishes persistence and exfiltrates sensitive secrets that could lead to broader cloud environment compromise. Total downloads for these packages have already reached over 2,600 users within a 24-hour window.