Four npm Packages Discovered Containing Malware, Including a Shai‑Hulud Clone
Remove these malicious packages from your dependencies and replace them with vetted alternatives; run npm audit.
Remove these malicious packages from your dependencies and replace them with vetted alternatives; run npm audit.
Summary
Cybersecurity researchers have identified four npm packages that embed information‑stealing malware, one of which is a clone of the Shai‑Hulud worm originally open‑sourced by TeamPCP. The malicious packages are chalk-tempalte (825 downloads), @deadcode09284814/axios-util (284 downloads), axois-utils (963 downloads), and color-style-utils (934 downloads). Chalk-tempalte was flagged as the most dangerous due to its ability to exfiltrate credentials. The other three packages also contain backdoors that can be triggered by specific API calls. Developers who have installed any of these packages should immediately remove them from their projects and run a full security audit. The incident highlights the need for stricter vetting of npm dependencies and continuous monitoring of package integrity. The npm registry has issued a warning and is working with maintainers to remove the compromised packages. Users are encouraged to update to the latest safe versions of related libraries.
Key changes
- Four npm packages identified as containing malware: chalk-tempalte, @deadcode09284814/axios-util, axois-utils, color-style-utils.
- Chalk-tempalte is a clone of the Shai‑Hulud worm.
- Each package has download counts ranging from 284 to 963.
- The packages embed backdoors that can exfiltrate credentials.
- npm has issued warnings and is removing the compromised packages.