The emergence of Shai-Hulud worm clones is creating new challenges for cybersecurity, following the release of the malware’s source code on GitHub by TeamPCP, according to a report by Ox Security. This development has raised concerns across the cybersecurity community as these clones are now actively being used in new attack campaigns.
Background on Shai-Hulud Malware
Originally appearing in September 2025, Shai-Hulud was first identified in supply chain attacks targeting the open source software sector. The malware resurfaced in November of the same year, impacting numerous NPM packages and potentially affecting thousands of developers. Designed to extract credentials, API keys, and tokens from compromised systems, Shai-Hulud cleverly propagates by embedding itself in packages managed by victims, subsequently distributing malicious versions.
In April, Shai-Hulud was linked to the hacking collective TeamPCP, which launched several assaults on the open source community. This included notorious incidents involving Trivy, Bitwarden, Checkmarx, SAP, and TanStack. The recent release of its source code has intensified its threat potential.
Impact of Source Code Release
The source code for the Shai-Hulud worm briefly appeared on GitHub, accompanied by a call from TeamPCP and BreachForums encouraging cybercriminals to exploit the code in a supply chain challenge. This open access has led to a rapid increase in activity associated with the malware, as noted by security experts.
Ox Security reports seeing immediate adaptation of the worm by cybercriminals, indicating a swift transition from code release to active exploitation. The threat landscape has been significantly altered by the availability of this code, enabling the creation of diverse malicious entities.
Current Threats and Future Implications
The immediate consequence of the code’s availability is the appearance of new malicious packages on NPM, including one named ‘chalk-tempalte’, a direct clone of Shai-Hulud. This package, unlike its predecessors, lacks obfuscation and establishes its own command-and-control server. It also uploads stolen credentials to a new GitHub repository, mirroring previous attack patterns.
Three additional packages, employing typo-squatting techniques to target Axios users, have been identified. While distinct from Shai-Hulud, one of these packages has been found to convert infected machines into a distributed denial-of-service (DDoS) botnet. Collectively, these packages have been downloaded over 2,600 times weekly, highlighting the scale of the threat.
Ox Security warns of an evolving threat landscape, with a single actor deploying various infostealer types and techniques. This marks the onset of what is expected to be a considerable wave of future supply chain attacks.
The cybersecurity community remains vigilant as the situation evolves, emphasizing the need for enhanced defensive strategies to counteract these sophisticated threats.
