Leaked Shai-Hulud malware fuels new npm infostealer campaign

Researchers at OXsecurity found four malicious npm packages (chalk-tempalte, @deadcode09284814/axios-util, axois-utils, color-style-utils) that include a non-obfuscated clone of the leaked Shai-Hulud infostealer and additional modules that exfiltrate developer credentials, secrets, crypto wallet data, and in one case add DDoS/“phantom bot” functionality; stolen data is sent to a reported C2 (87e0bbc636999b.lhr.life) and some uploads can publish stolen credentials to public GitHub repositories—developers are advised to remove affected packages and rotate credentials.