---
title: "Leaked Shai-Hulud malware fuels new npm infostealer campaign"
url: https://daily.dev/posts/leaked-shai-hulud-malware-fuels-new-npm-infostealer-campaign-p5hgfgg74
source_url: https://www.bleepingcomputer.com/news/security/leaked-shai-hulud-malware-fuels-new-npm-infostealer-campaign
type: article
source: "BleepingComputer"
published: 2026-05-18T17:33:11.217Z
updated: 2026-08-24T07:06:38.817Z
tags: ["cyber", "malware", "npm"]
reading_time: 3
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Leaked Shai-Hulud malware fuels new npm infostealer campaign

**[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments

## Summary

A threat actor has deployed four malicious npm packages using leaked Shai-Hulud malware source code, originally attributed to the TeamPCP hacker group. The packages use typosquatting to target Axios users and steal developer credentials, secrets, cryptocurrency wallet data, and cloud configuration files. One package also includes DDoS botnet functionality supporting HTTP, TCP, and UDP floods. Discovered by OXsecurity, the packages had a combined 2,678 downloads. Stolen credentials are exfiltrated to a C2 server and uploaded to auto-generated public GitHub repositories. Developers who downloaded the affected packages are advised to remove them immediately and rotate all credentials and API keys.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.bleepingcomputer.com/news/security/leaked-shai-hulud-malware-fuels-new-npm-infostealer-campaign>

## Similar posts on daily.dev

- [New Shai-Hulud malware wave compromises 600 npm packages](https://daily.dev/posts/new-shai-hulud-malware-wave-compromises-600-npm-packages-fc6izpxyv) · BleepingComputer · 5 upvotes · 1 comments

---

Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm)

[View this post on daily.dev](https://daily.dev/posts/leaked-shai-hulud-malware-fuels-new-npm-infostealer-campaign-p5hgfgg74)