TeamPCP Open-Sources “Shai-Hulud” AI Supply Chain Malware, Hitting NPM Fleet

The threat collective recognized as TeamPCP, historically notorious for orchestrating supply chain incursions within the NPM ecosystem, has open-sourced an artificial intelligence-synthesized worm virus designated as Shai-Hulud—a moniker derived from the iconic sandworms of the science fiction epic Dune. Although Microsoft expeditiously expunged the open-source repository hosting this worm, the underpinning codebase had already proliferated across the internet, and opportunistic threat actors have commenced weaponizing it in active deployment campaigns.

During a routine telemetry scan of the NPM registry, the cybersecurity enterprise OX intercepted four newly published packages harboring malicious code blocks. Critically, one of these artifacts contained a literal clone of the Shai-Hulud worm; the adversary responsible for its deployment merely altered the hardcoded Command-and-Control (C2) server infrastructure while leaving peripheral functional parameters entirely untouched.

The designations and corresponding download metrics of the malicious NPM containers are enumerated below:

• @chalk-tempalte: Approximately 800 downloads.
• @axios-util: Approximately 300 downloads (engineered to masquerade as the ubiquitous Axios utility).
• @axois-util: Approximately 900 downloads (a typosquatting variant structurally identical in deceptive intent to the former).
• @color-style-utils: Approximately 900 downloads.

A forensic analysis conducted by the OX security team revealed that the @chalk-tempalte package directly encapsulated the open-source Shai-Hulud worm framework. While each of these malicious containers was distributed by a singular user identity, @deadcode09284814, the underlying payloads diverged significantly in their technical composition. The specific iteration embedded with the worm architecture focuses primarily on harvesting a developer’s sensitive authentication credentials; upon successful exfiltration, the worm weaponizes these legitimate tokens to fuel its own lateral propagation across adjacent ecosystems.

The open-sourcing of this worm framework presents a lucrative opportunity for contemporary cybercriminals. By replicating the Shai-Hulud repository and merely substituting the C2 destination, downstream adversaries can deploy highly sophisticated malware absent the necessity of authoring bespoke logic. This paradigm of commoditized exploitation is projected to undergo rapid expansion, effectively ensuring that the Shai-Hulud lineage will permanently endure within the threat landscape.

A selection of the network indicators and command nodes leveraged in these campaigns includes the following:

• 87e0bbc636999b.lhr[.]life
• 80.200.28[.]28:2222
• edcf8b03c84634.lhr[.]life