Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware

The Hacker News reports the discovery of four new npm packages embedding information-stealing malware. One of these, chalk-tempalte, is a direct clone of the open-source Shai-Hulud worm developed by TeamPCP. The other identified malicious packages are @deadcode09284814/axios-util, axois-utils, and color-style-utils.

These packages deliver both infostealers and Phantom Bot DDoS malware, posing a dual threat. The infostealers aim to exfiltrate sensitive data, while the DDoS component prepares compromised systems for denial-of-service attacks. The download counts for these packages—ranging from 284 to 963—indicate a concerning level of adoption before discovery.

This incident underscores the persistent supply chain risk within public package registries like npm. Attackers are constantly leveraging typosquatting and legitimate-looking package names to trick developers into integrating malicious code. It’s a low-cost, high-impact attack vector that bypasses traditional perimeter defenses.