Miasma: czirker/llxlr npm Account Publishes Malicious LeoPlatform Packages

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects instances of npm package publication events initiated by known-compromised maintainer accounts (czirker, llxlr). These accounts have been identified as being used to distribute malicious packages, such as leo-aws versions, representing a software supply chain compromise.