First Shai-Hulud Worm Clones Emerge

Shai-Hulud malware clone spreads via NPM, targeting developers in a new wave of open source supply chain attacks.

May 18, 2026

ON THIS PAGE

Cybercriminals have already cloned the Shai-Hulud malware just days after TeamPCP released its source code on GitHub. The original worm first hit the open source ecosystem in September 2025, stealing credentials and API keys from developers to spread through NPM packages.

Ox Security discovered four malicious NPM packages, including 'chalk-tempalte' - a direct clone of Shai-Hulud. The packages have been downloaded over 2,600 times weekly, targeting Axios users through typo-squatting attacks. One package even enslaves infected machines into a DDoS botnet.

Security researchers warn this marks the beginning of a major wave of supply chain attacks targeting the open source community.

Source: Security Week

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?