A fresh supply-chain wave tied to the Mini Shai-Hulud, Miasma, and Hades malware families is actively poisoning npm packages in the LeoPlatform and RStreams ecosystems and expanding into source-repository compromises.
The intrusion blends registry poisoning, install-time execution via binding.gyp, Bun-staged JavaScript loaders, GitHub Actions abuse, and persistence hooks for IDEs and AI coding assistants an execution pattern built to harvest developer and CI/CD secrets and to propagate across registries and repositories.
The immediate technical vector in the LeoPlatform wave is the “Phantom Gyp” pattern. Malicious packages omit visible preinstall/postinstall scripts and instead include a binding.gyp file; npm’s node-gyp invocation processes that file during install, enabling shell command expansion and arbitrary code execution.
In affected releases the package’s index.js is replaced by a one-line loader that performs multi-stage unpacking: a ROT-style letter shift that evals a first-stage loader, AES-GCM decryption of embedded payload blobs, and JavaScript-obfuscator-style runtime reconstruction.
If Bun is not present, the loader attempts to fetch or install it and then runs the main payload under bun run, exploiting the fact that many Node security hooks have weaker coverage for Bun execution.
Once staged, the Miasma/Hades payload executes targeted credential collection. The code searches for .env files, npm and PyPI tokens, GitHub tokens, cloud provider credentials (AWS, Azure, GCP), Docker and Kubernetes configs, SSH keys, Vault data, CI secrets, IDE and AI-agent configurations, Slack and Twilio tokens, and shell histories.
It also probes for EDR and endpoint tooling (CrowdStrike, SentinelOne, Microsoft Defender, Carbon Black, osquery, Tanium, Qualys) and uses locale guards to avoid some forensic environments.
Socket said in a report shared with GBhackers, tracking this campaign, attributes a rapid publish burst on June 24, 2026 to the same operational cluster that previously targeted PyPI and bioinformatics projects.
leo-aws@2.0.4, one of the malicious packages identified in the current Miasma Mini Shai-Hulud wave (Source : Socket).Collected secrets are encrypted and exfiltrated via GitHub API behaviors that include repository creation and artifact uploads; the campaign has repeatedly used a “dead-drop” approach where commit messages or repo content act as retrieval channels, a tactic observed previously in activities named RevokeAndItGoesKaboom.
GitHub Actions are a primary target and a propagation mechanism. The malware looks for workflows that perform publishing and tries to steal runner-scoped secrets from memory or the environment.
binding.gyp (Source : Socket).Attackers also pushed repository-level poison snapshot-* branches and Dependabot-like workflows containing large _index.js payloads and fake update flows to persist and trigger later execution.
A recurring workflow name, “Run Copilot,” is used as camouflage for an action that exfiltrates GitHub Actions secrets into uploaded artifacts.
This tradecraft echoes adjacent incidents such as the codfish/semantic-release-action compromise, where attackers leveraged mutable tags and Bun-run obfuscated JavaScript to escalate impact across dependent repositories.
A merged fix changed a validation workflow away from pull_request_target, while the prior workflow combined pull_request_target with checkout of the pull request head SHA.
The campaign is not limited to npm. Socket identified a Go module/source-archive compromise in the Verana Blockchain project where staged payloads live in a .claude folder and a VS Code folder-open task invokes node .claude/setup.mjs.
That sample does not execute via Go tooling; instead it weaponizes developer workflows and IDE triggers, reinforcing that the attacker targets the intersection of package ecosystems, IDEs, and AI coding assistants to achieve delayed, developer-initiated execution.
Mitigation requires treating any environment that installed affected versions as potentially compromised: preserve forensics, identify all developer machines and CI runners, remove and rebuild from known-good lockfiles, and rotate all exposed credentials from a clean host.
Audit repositories for injected workflows, Claude/Gemini/Copilot hooks, .github/setup.js or _index.js payloads, orphan branches, and unexpected Bun usage.
Socket’s tracking page aggregates artifacts and updates at https://socket.dev/supply-chain-attacks/miasma-mini-shai-hulud-supply-chain-attack and includes prior coverage of related waves: Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave and Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels.
| Package / File | Path / Item | SHA-256 hash |
|---|---|---|
| Confirmed LeoPlatform/RStreams set | binding.gyp | 32d1bc728d8e504952083a6adc488c309a401c7df4dc8f47b382ce32e4aebe21 |
| leo-logger@1.0.8 | index.js | 57ba86f6f0caaa580c1dccdf4ed7873d1470e5ea2f8e9ca7a989dc04899f13c0 |
| leo-logger@1.0.8 | package.json | 4a0aa78757958683155a7b9289427fb829abcad1bf5ee6399eb73e8409b0bc11 |
| leo-sdk@6.0.19 | index.js | 026588d39b7c650b5c0dfbba6c6fcc0e7ec8e3b72ba8639012e7f71c708f2c3b |
| leo-auth@4.0.6 | index.js | df9ea0c71574e11c93141ad2f018a63a5375cd6d69ca2f744732ad7814170657 |
| leo-aws@2.0.4 | index.js | 1a3b9ed0b377f56f49b9a703612cf45e86ab7d100587e1e7a476d809fe337a8c |
| leo-sdk@6.0.19 | npm tarball | f565988f281bf77bcad26ea7f543617e53da4b62f5df63d4f7a89bae1729cf81 |
| leo-auth@4.0.6 | npm tarball | a934a5bcf692b9d01e8129bf264be23809dfee464df471d75a9f3fa1bcede343 |
| leo-aws@2.0.4 | npm tarball | f7c47be306351ffacd46584d2067f7be676dbfe17cd89ab4880632decfe18f3d |
| leo-cli@3.0.3 | npm tarball | 3da2ca129c9920d9acd2e3477aee8f46b5a5f0e9537ad6e7b6ab1df1007adad1 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…