Four malicious npm packages delivering information-stealing and worm-like malware have been removed from the JavaScript ecosystem after researchers warned they were abusing developer systems to exfiltrate credentials and potentially stage broader attacks. The packages — chalk-tempalte, @deadcode09284814/axios-util, axois-utils, and color-style-utils — collectively recorded more than 3,000 downloads before being taken down, according to analysis shared by supply chain security researchers and corroborated by npm registry telemetry.
Investigators say at least one of the packages appears to clone or closely mimic code from the Shai-Hulud worm, a self-propagating npm malware strain previously detailed in a sweeping supply chain campaign that compromised hundreds of packages and popular libraries like debug and chalk. In that earlier incident, documented by firms including Aikido, GitLab, Trend Micro, and Socket, Shai-Hulud relied on malicious install-time scripts to pull down additional payloads, scan developer environments for sensitive tokens, and use stolen credentials to republish trojanized packages under trusted maintainer accounts, effectively turning every infected project into a new infection vector for the wider ecosystem (The Hacker News, GitLab, Trend Micro).
In the latest discovery, the four npm packages masquerade as innocuous developer utilities, borrowing names and namespaces that resemble legitimate color and HTTP helper libraries. Once installed, their scripts reach out to attacker-controlled infrastructure to retrieve additional JavaScript payloads. These payloads function primarily as infostealers, scraping environment variables, local configuration files, and authentication stores for GitHub tokens, npm access tokens, and cloud provider keys in a pattern consistent with previous Shai-Hulud–related tooling that downloaded and executed the TruffleHog secrets scanner to trawl developer machines for credentials (Palo Alto Networks, JFrog).
Researchers who analyzed the malicious code say the reuse of Shai-Hulud techniques — including automated credential harvesting and worm-like propagation logic — highlights how quickly proof-of-concept malware and exposed offensive tooling can be repackaged and re-deployed across software registries. Previous reporting has noted that Shai-Hulud’s operators and copycats have experimented with multiple payloads, from secret theft and repository cloning to cryptocurrency-stealing code that hijacks browser and Node.js APIs to intercept wallet interactions, underscoring the flexibility of this attack model once a maintainer account or CI environment is compromised (Trend Micro, Upwind).
There are no CVE identifiers associated with these malicious packages, since they are outright malware rather than vulnerable software, but the impact for organizations that installed them can be severe. Any environment where the packages were built or executed should be treated as potentially compromised, because attackers who obtain valid npm and GitHub tokens can silently publish new backdoored releases, create or expose private repositories, and pivot into CI/CD systems and cloud infrastructure. In earlier phases of the Shai-Hulud campaign, compromised accounts were used to mass-publish trojanized updates in under two hours, briefly poisoning widely used dependencies before they were detected and removed (Palo Alto Networks).
Defenders are urged to immediately audit logs for any use of chalk-tempalte, @deadcode09284814/axios-util, axois-utils, or color-style-utils, remove them from all projects, and revoke and rotate any credentials present on systems where the packages may have run. Security teams should also scrutinize npm publish history for unexpected releases, enable hardware-backed or phishing-resistant multifactor authentication on developer accounts, and consider implementing automated scanning for anomalous install and publish scripts, particularly postinstall hooks that download and execute remote code. Given the speed with which worm-like attacks such as Shai-Hulud can fan out through package maintainers and CI pipelines, rapid credential hygiene and registry monitoring remain critical to containing the fallout.
