Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp" Trick and Bun Runtime to Steal Developer Credentials Across npm, Go, and RubyGems — Threadlinqs Intelligence
As of 2026-06-26, Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp" Trick and Bun Runtime to Steal Developer Credentials Across npm, Go, and RubyGems is a high-severity supply chain threat attributed to Unknown (Miasma, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-1242 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Unknown (Miasma · FINANCIAL
The Miasma campaign (part of the Mini Shai-Hulud / Hades malware cluster) compromised 20+ npm packages in the LeoPlatform/RStreams ecosystem plus other npm packages, a Go module (Verana Blockchain),
Miasma is an active, self-propagating supply-chain malware campaign first observed publishing over 20 malicious npm package versions within a tight window on June 24, 2026, targeting the LeoPlatform and RStreams data-pipeline ecosystem (leo-sdk, leo-auth, leo-aws, leo-cli, leo-logger, and 14 related packages) as well as unrelated packages published under the npm account "llxlr" (hexo-deployer-wrangler, hexo-shoka-swiper, prism-silq, solo-nav). Socket.dev researchers attribute the cluster to the same lineage as Mini Shai-Hulud and Hades, tracking 471+ affected artifacts across npm and PyPI at the time of reporting.
The core technique, dubbed "Phantom Gyp" by StepSecurity, abuses the fact that npm automatically invokes node-gyp when a package contains a binding.gyp file, even for packages that have no legitimate native-addon requirement. The malicious binding.gyp uses gyp's command-substitution syntax — e.g. `"sources": ["<!(node index.js > /dev/null 2>&1 && echo stub.c)"]` — to execute an oversized (4+MB), heavily obfuscated root-level index.js during `npm install`, entirely bypassing the preinstall/postinstall hooks that most supply-chain security tooling monitors. The legitimate package logic is left untouched in dist/; the malicious index.js is never imported by any application code and exists purely to be triggered by node-gyp.
The payload uses a multi-layer obfuscation chain: a Caesar-cipher-shifted first-stage loader evaluated via eval(), which decrypts AES-GCM-encrypted embedded stages, which in turn detect or silently install the Bun JavaScript runtime (downloading Bun v1.3.13 from github.com/oven-sh/bun/releases if absent) and execute the final stage via `bun run` outside the Node.js process tree — evading security tools and EDR hooks that instrument Node.js but not Bun execution.
Once running, Miasma harvests an extremely broad set of developer and CI/CD secrets: npm, PyPI, and RubyGems tokens; GitHub, Slack, and Twilio credentials; SSH keys; Docker auth files; Kubernetes service-account material; AWS/Azure/GCP credentials; HashiCorp Vault data; shell history and .env files; and configuration for AI coding assistants (Claude, Cursor, Gemini, GitHub Copilot). Stolen data is RSA-wrapped, packaged as encrypted JSON, and exfiltrated to attacker-controlled GitHub repositories under the account liuende501 (236+ programmatically created repos), written via the GitHub Contents API to paths like `repos/liuende501/{repo}/contents/results/results-{timestamp}.json`. The malware also uses GitHub commit-search as a dead-drop/beacon channel, searching for operator tokens such as "thebeautifulmarchoftime" (status check) and "IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner" (token validation), alongside the shared campaign marker "RevokeAndItGoesKaboom" that links the npm and GitHub Actions attack clusters.
Miasma self-propagates worm-style: using stolen npm tokens it calls the registry.npmjs.org/-/whoami endpoint to validate credentials, enumerates the compromised maintainer's other packages, downloads them, injects fresh binding.gyp/index.js payloads, forges SLSA provenance attestations via Sigstore so the republished packages appear legitimately built through CI, and republishes — reinfecting 57 packages across 286+ malicious versions in under two hours during observed bursts. An equivalent technique targets RubyGems by injecting the payload into extconf.rb, Ruby's native-extension build mechanism, with a matching Bun downloader.
The campaign also poisons GitHub repositories directly: attackers push orphan `snapshot-*` branches containing fake Dependabot-like dependency-update workflows and a "Run Copilot" GitHub Actions workflow template that appears to invoke GitHub Copilot but instead exfiltrates Actions secrets by uploading them as workflow artifacts. These workflows request elevated Actions publishing permissions and exploit mutable-tag GitHub Actions checkouts and pull_request_target workflows that check out untr
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357, CWE-798
Target sectors: technology, software-development, cloud-services, open-source, devops, blockchain
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1199, T1195, T1195.001, T1195.002, T1059.007, T1204, T1053, T1610, T1546, T1505
