Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware

Researchers uncovered four malicious npm packages (chalk-tempalte, @deadcode09284814/axios-util, axois-utils, color-style-utils) published by a single account that install multiple malware types: three info-stealers (including a near-exact clone of the Shai-Hulud worm) and a Golang DDoS botnet named Phantom Bot that establishes persistence and exfiltrates credentials, SSH keys, cloud secrets, system info and crypto wallet data to observed C2 domains/IPs; users are advised to uninstall the packages, rotate secrets, remove malicious IDE/agent configs, search for the linked GitHub repo, and block the listed domains/IPs.