Executive Summary
A sophisticated supply chain attack linked to the Miasma, Mini Shai-Hulud, and Hades malware families targeted the LeoPlatform npm ecosystem and the Verana Blockchain Go module on June 24, 2026. The attackers compromised maintainer accounts (e.g., czirker, llxlr) to publish malicious versions of at least 20 packages and push weaponized GitHub Actions workflows disguised as Dependabot. The campaign has expanded beyond Node.js, targeting Go source repositories through poisoned IDE configurations and VS Code folder-open tasks.
The technical execution involves a stealthy 'Phantom Gyp' pattern using binding.gyp to trigger a multi-stage, obfuscated JavaScript payload during installation. Once active, the malware stages a Bun runtime to execute a credential stealer designed to harvest secrets from npm, GitHub, AWS, Kubernetes, and AI coding tools like Claude and Cursor. The urgency is high as the malware uses stolen credentials to self-propagate, infecting additional repositories and registries accessible via the compromised environment.