Miasma Malware Supply Chain Attack Targets npm Packages, Go Module, and GitHub Actions CI/CD Pipelines
Miasma Malware Supply Chain Attack Targets npm Packages, Go (TL-2026-0963), also tracked as Miasma, is a critical-severity supply-chain compromise, first published 2026-06-27. It has no confirmed attribution, affects LeoPlatform / RStreams leo-auth npm package, maps to 36 MITRE ATT&CK techniques (T1003, T1005, T1020), and is covered by 9 detection rules and 33 indicators of compromise.
Key facts for TL-2026-0963
- Threat ID
- TL-2026-0963
- Also known as
- Miasma, Mini Shai-Hulud, Hades, Phantom Gyp, Operation Spreading Blight
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-27
- Last reviewed
- 2026-06-27
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, open-source, finance, cloud-infrastructure, devops
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 33
Malware and tooling in Miasma Malware Supply Chain Attack Targets npm Packages, Go
Malware and tooling: Hades, Mini Shai-Hulud, Miasma
The Miasma malware family (variants: Mini Shai-Hulud, Hades) executed a coordinated software supply chain attack in June 2026, compromising 24 npm packages across the LeoPlatform and RStreams ecosystems, poisoning a Go module (verana-blockchain v0.10.1-dev.20), and force-pushing malicious commits to the widely-used codfish/semantic-release-action GitHub Action — exposing 1,442 dependent repositories. The campaign deploys a novel 'Phantom Gyp' dropper using binding.gyp to trigger obfuscated JavaScript loaders that install the Bun runtime and launch a credential stealer harvesting GitHub OIDC tokens, PATs, AWS/Azure/GCP credentials, SSH keys, and CI/CD secrets, exfiltrating them via AES-128-GCM encrypted uploads to 559+ attacker-controlled GitHub dead-drop repositories using the GitHub GraphQL API.
How Miasma Malware Supply Chain Attack Targets npm Packages, Go works
The Miasma campaign represents one of the most sophisticated and broad-reaching software supply chain attacks observed in 2026, combining npm package poisoning, Go module compromise, and GitHub Actions hijacking into a coordinated multi-ecosystem assault targeting developer credentials and CI/CD infrastructure.
The LeoPlatform/RStreams npm compromise was executed on 2026-06-24 at 23:04:55 UTC when the attacker used a stolen npm publish token from the compromised 'czirker' maintainer account to push 20 malicious package versions in a coordinated 3-second burst, exploiting the npm bypass_2fa API to circumvent multi-factor authentication. Three additional packages (hexo-deployer-wrangler, hexo-shoka-swiper, prism-silq) were published by a secondary attacker-controlled publisher account 'llxlr'. The total exposure across the 20 LeoPlatform/RStreams packages was approximately 13,600 weekly downloads.
The malware uses a novel execution technique dubbed 'Phantom Gyp': by adding a binding.gyp file to pure-JavaScript packages, npm install triggers node-gyp, whose shell expansion syntax (<!(node index.js)) executes the malicious index.js before build. The index.js contains a large, single-line heavily obfuscated JavaScript loader that applies ROT-N (Caesar-style letter shift) followed by AES-128-GCM decryption to unpack the second-stage payload. If the Bun JavaScript runtime (v1.3.13) is not present, it is downloaded from the official GitHub releases and installed. The final malware payload runs under Bun, which evades many Node.js-focused security monitoring tools.
The credential stealer harvests an extraordinarily wide range of secrets: .env files, npm and PyPI authentication tokens, GitHub Personal Access Tokens, GitHub OIDC tokens, SSH private keys, Docker authentication files (~/.docker/config.json), Kubernetes configurations (~/.kube/config), AWS/Azure/GCP cloud credentials, HashiCorp Vault data, Slack and Twilio API tokens, shell history, and CI/CD runner secrets accessed via direct /proc/{pid}/mem memory reads on Linux systems. The malware further targets AI coding assistant configuration files (.claude/settings.json, .gemini/settings.json, .cursor/rules/setup.mdc) and IDE configurations (.vscode/tasks.json), enabling lateral propagation into AI-assisted development workflows.
Exfiltration uses the victim's own stolen GitHub token to upload AES-128-GCM encrypted credential bundles to 559+ attacker-controlled public GitHub repositories (accounts: liuende501 with 236 repos, windy629 with 200+ repos, HerGomUli) via the GitHub GraphQL API. Repository descriptions 'Miasma - The Spreading Blight' and 'Alright Lets See If This Works' are campaign fingerprints. The malware also polls GitHub hourly for commits containing the string 'firedalazer' to receive and execute new Hades variant commands, establishing a durable GitHub-based C2 channel using commit message dead-drops with markers including 'RevokeAndItGoesKaboom' and 'TheBeautifulSandsOfTime'.
Persistence mechanisms include injecting a GitHub Actions workflow named 'Run Copilot' to blend with AI development workflows, creating fake Dependabot branches ('snapshot-*') containing malicious '_index.js' files, and planting backdoor hooks into AI/IDE configuration paths to ensure re-execution whenever those tools load. On compromised systems with access to npm, PyPI, or RubyGems publish rights, the worm attempts self-propagation by pushing trojanized versions to all packages the victim has publish access to.
The codfish/semantic-release-action GitHub Action was force-pushed at 2026-06-24 15:39:06 UTC, with all version tags (v1.6.1 through v5) redirected to the malicious commit. The action was converted from Docker-based to composite form, injecting two malicious steps guarded with 'if: always()' to execute even on pipeline failure. The 512KB obfuscated payload (AES-256-CBC encrypted with hardcoded key bd8035203526735490e4bd5cdcede581b9d3a3f7a5df7725859844d8dcc8eb49) steals GitHub OIDC tokens and PATs, propagates backdoors to accessible repositories, performs SSH lateral movement, and carries secondary payload builders for npm, PyPI, and RubyGems ecosystems.
The verana-blockchain Go module attack takes a different execution approach: instead of binding.gyp, it relies on IDE and AI coding assistant auto-execution. The malicious archive includes .claude/settings.json configuring a Claude hook pointing to .github/setup.js, and .vscode/tasks.json with a folder-open trigger executing the Bun launcher — meaning simply opening the project in VS Code or using a Claude Code session initiates the payload.
Two key evasion controls are present across all variants: a Russian locale killswitch (aborting if system locale is Russian) suggesting threat actor location, and active EDR detection scanning for CrowdStrike, SentinelOne, Microsoft Defender, Carbon Black, Cylance, osquery, Tanium, and Qualys before executing the payload. Forensic attribution fingerprints shared across this campaign and prior Shai-Hulud waves (TanStack, echarts, @antv/graphlib, Red Hat packages) include use of Bun v1.3.13 as the execution runtime, the three-layer obfuscation stack (ROT-N + AES-128-GCM + obfuscator.io), and consistent GitHub dead-drop infrastructure patterns.
MITRE ATT&CK techniques used in TL-2026-0963
Credential Access
T1003 OS Credential Dumping; T1528 Steal Application Access Token; T1552 Unsecured Credentials
Collection
T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories
Exfiltration
T1020 Automated Exfiltration; T1567 Exfiltration Over Web Service
Lateral Movement
T1021 Remote Services; T1080 Taint Shared Content
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Persistence
T1053 Scheduled Task/Job; T1525 Implant Internal Image; T1546 Event Triggered Execution
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise
Impact
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
stealth
Resource Development
T1585 Establish Accounts; T1586 Compromise Accounts; T1588 Obtain Capabilities; T1608 Stage Capabilities
Reconnaissance
Affected products and versions in Miasma Malware Supply Chain Attack Targets npm Packages, Go
- LeoPlatform / RStreams — leo-auth npm package
Vulnerable versions: 4.0.6 - LeoPlatform / RStreams — leo-aws npm package
Vulnerable versions: 2.0.4 - LeoPlatform / RStreams — leo-cache npm package
Vulnerable versions: 1.0.2 - LeoPlatform / RStreams — leo-cdk-lib npm package
Vulnerable versions: 0.0.2 - LeoPlatform / RStreams — leo-cli npm package
Vulnerable versions: 3.0.3 - LeoPlatform / RStreams — leo-config npm package
Vulnerable versions: 1.1.1 - LeoPlatform / RStreams — leo-connector-elasticsearch npm package
Vulnerable versions: 2.0.6 - LeoPlatform / RStreams — leo-connector-mongo npm package
Vulnerable versions: 3.0.8 - LeoPlatform / RStreams — leo-connector-mysql npm package
Vulnerable versions: 3.0.3 - LeoPlatform / RStreams — leo-connector-oracle npm package
Vulnerable versions: 2.0.1
Remediation for Miasma Malware Supply Chain Attack Targets npm Packages, Go
Patches
- Upgrade to clean versions of all affected LeoPlatform/RStreams npm packages once published by maintainers on uncompromised accounts
- Update codfish/semantic-release-action pin to a post-compromise verified commit SHA
- Replace verana-blockchain Go module dependency with a verified clean release
Immediate actions
- Audit all dependency lockfiles, internal package mirrors, container images, and CI runner caches for any of the 24 malicious npm package versions immediately
- Rotate ALL developer and CI secrets from clean, uncompromised machines: npm tokens, GitHub PATs, PyPI tokens, AWS/Azure/GCP credentials, Kubernetes configs, Docker credentials, SSH keys, Slack tokens, HashiCorp Vault tokens, Twilio tokens
- Pin codfish/semantic-release-action and ALL GitHub Actions to full-length immutable commit SHAs — not mutable version tags
- Audit GitHub repositories for injected 'Run Copilot' workflow files, snapshot-* Dependabot branches, and malicious AI-agent hook files (.claude/, .gemini/, .cursor/ directories)
- Remove verana-blockchain@v0.10.1-dev.20 from all Go module caches and replace with a verified clean version
- Block Bun runtime downloads (github.com/oven-sh/bun/releases/) in CI environments via egress filtering
- Search GitHub Actions run logs for: unexpected Bun downloads, new repository creation events, artifact uploads, unexpected GitHub API GraphQL calls
Workarounds
- Disable node-gyp execution in CI environments where native addons are not required (--ignore-scripts npm install flag)
- Audit and remove any .claude/settings.json, .gemini/settings.json, .vscode/tasks.json, and .cursor/rules/setup.mdc files added by dependencies
- Block the 3 identified attacker GitHub accounts (liuende501, windy629, HerGomUli) at the network level
- Temporarily disable npm publish rights for all maintainer accounts under investigation until tokens are rotated
Longer-term hardening
- Implement npm two-factor authentication enforcement and audit all maintainer token scopes across packages
- Require GITHUB_TOKEN permissions to be explicitly scoped (read-only) for all GitHub Actions workflows
- Deploy supply chain security scanning (Socket.dev, Snyk, Sonatype) with blocking on new package publications
- Implement SBOM generation and dependency verification using Sigstore/cosign for all build artifacts
- Monitor for new GitHub repository creation by CI tokens using GitHub audit log streaming
- Deploy behavioral EDR rules detecting Bun runtime execution, /tmp/p*.js file creation, and /proc/pid/mem access patterns
- Restrict pull_request_target workflows to prevent untrusted PR head checkouts
- Establish allowlist-based CI runner egress filtering blocking access to attacker-controlled dead-drop GitHub accounts
Weaknesses (CWE) in Miasma Malware Supply Chain Attack Targets npm Packages, Go
CWE-506, CWE-829, CWE-494, CWE-522, CWE-798, CWE-295
Timeline of Miasma Malware Supply Chain Attack Targets npm Packages, Go
- Microsoft Security Blog documents Mini Shai-Hulud compromise of @antv/graphlib npm packages enabling CI/CD credential theft — earliest confirmed Miasma campaign wave with shared TTPs (Bun runtime, binding.gyp, GitHub dead-drop exfiltration)
- Prior Miasma wave compromises 57 npm packages across 286+ versions, expanding campaign scope to TanStack, echarts, Red Hat, and bioinformatics/MCP PyPI packages — establishing the worm's self-propagation infrastructure including the 559+ dead-drop GitHub repository network
- Additional malicious npm packages (hexo-deployer-wrangler@1.0.4, hexo-shoka-swiper@0.1.10, prism-silq@1.0.1) published by secondary attacker-controlled npm publisher account 'llxlr', extending campaign reach beyond LeoPlatform ecosystem
- verana-blockchain@v0.10.1-dev.20 Go module (Cosmos SDK-based Layer 1 / Verifiable Public Registry) published with embedded Miasma payload; attack vector differs from npm — relies on IDE/AI-assistant auto-execution via .vscode/tasks.json folder-open trigger and .claude/settings.json hook, not binding.gyp
- Attacker uses stolen npm publish token from compromised maintainer account 'czirker' to publish 20 malicious LeoPlatform/RStreams npm package versions in a coordinated 3-second burst at 23:04:55 UTC, exploiting npm bypass_2fa API to circumvent 2FA; approximately 13,600 weekly downloads across affected packages exposed
- Attacker force-pushes malicious commit to codfish/semantic-release-action GitHub repository at 15:39:06 UTC; all version tags v1.6.1 through v5.x redirected to malicious commit containing 512KB obfuscated JavaScript payload run via Bun — 1,442 dependent repositories exposed to credential theft and supply chain propagation
- StepSecurity publishes advisories for both the codfish/semantic-release-action compromise and the mass LeoPlatform npm compromise, including detection guidance and remediation steps for CI/CD pipeline owners
- Socket Research Team publishes detailed analysis of LeoPlatform/RStreams npm compromise, first public disclosure of the Phantom Gyp technique and full package IOC list
- Concurrent Hades variant campaign identified targeting PyPI with 37 malicious wheels across 19 packages, sharing AES key and obfuscation infrastructure with the npm/Go/GitHub Actions wave — confirming Miasma as a coordinated multi-registry campaign
- The Hacker News, The Register, Sonatype, Semgrep, GBHackers, CyberSecurityNews, SafeDep, Snyk, Corgea, Phoenix Security, and Microsoft Threat Intelligence all publish analysis; 559+ attacker GitHub dead-drop repositories identified across accounts liuende501 (236 repos), windy629 (200+ repos), and HerGomUli
- Campaign C2 remains active: malware on compromised systems polls GitHub hourly for commits matching 'firedalazer' string to receive Hades variant commands; dead-drop repositories continue to accumulate encrypted stolen credentials from victim CI/CD pipelines
Sources cited for Miasma Malware Supply Chain Attack Targets npm Packages, Go
- Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
- Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and Go Ecosystem
- StepSecurity: Supply Chain Compromise - codfish/semantic-release-action
- StepSecurity: Mass npm Supply Chain Attack — 20 Leo Platform Packages Compromised
- Miasma Returns: Leo Platform Compromise in npm — Sonatype Analysis
- Miasma Malware Uses binding.gyp and Bun to Evade Detection
- Miasma v2 Self-Spreading npm Worm Now Uses Malicious binding.gyp File and Compromises 57 Packages
- Mini Shai-Hulud Worm Poisons LeoPlatform npm Packages — GBHackers
- Miasma Worm Targets AI Coding Agents — SafeDep Analysis
- Leo Platform npm Packages Compromised with Phantom Gyp — Corgea Research
- Node-gyp Supply Chain Compromise: Self-Propagating npm Worm via binding.gyp — Snyk
- Miasma Campaign Poisons 20-Plus npm Packages — The Register
- Microsoft Threat Intelligence on Miasma Campaign
- Miasma Azure/Hades/PyPI Wave Analysis — Phoenix Security
- Mini Shai-Hulud: Compromised @antv/graphlib npm Packages Enable CI/CD Credential Theft — Microsoft Security Blog
Threats related to Miasma Malware Supply Chain Attack Targets npm Packages, Go
- Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp" Trick and Bun Runtime to Steal Developer Credentials Across npm, Go, and RubyGems
- ChainDrop npm Supply-Chain Compromise: Self-Propagating Mini Shai-Hulud Credential-Stealing Worm Affecting 444+ Packages
- Binding.gyp "Phantom Gyp" Supply Chain Attack (Miasma Worm) Enables CI/CD Worm Propagation Across 57 npm Packages
- Keyv and Cacheable npm Supply Chain Attack via Compromised Maintainer Account (Shai-Hulud Malware)
- Mastra npm Supply Chain Attack: 141 @mastra/* Packages Backdoored via easy-day-js Typosquat to Deploy Cross-Platform Infostealer/RAT
- Miasma / Shai-Hulud Supply-Chain Campaign Pushes Password-Stealing Malware via Compromised Microsoft GitHub Repos (durabletask PyPI 1.4.1-1.4.3)
Detection coverage for TL-2026-0963
As of 2026-06-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0963 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.