Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem
A sophisticated supply chain attack campaign linked to Mini Shai-Hulud, Miasma, and Hades malware has compromised LeoPlatform npm packages, GitHub Actions workflows, and the Verana Blockchain Go module. The attack employs binding.gyp install-time execution, Bun-staged JavaScript malware, and encrypted credential exfiltration targeting developer and CI/CD environments. Malicious packages were published through the czirker and llxlr npm accounts in a coordinated burst on June 24, 2026. The campaign steals credentials including npm tokens, GitHub tokens, cloud provider credentials, SSH keys, and AI coding assistant configurations. Attackers use GitHub as dead-drop infrastructure and inject persistence hooks into repositories through orphan branches and fake dependency-update workflows. The RevokeAndItGoesKaboom marker connects this wave to the codfish/semantic-release-action compromise, indicating shared operational tooling.
AI Analysis
Technical Summary
This threat involves a supply chain attack campaign attributed to malware families Mini Shai-Hulud, Miasma, and Hades. It targets LeoPlatform npm packages, GitHub Actions workflows, and the Verana Blockchain Go module. The attack vector includes install-time execution via binding.gyp, Bun-staged JavaScript malware, and encrypted exfiltration of developer and CI/CD credentials. Malicious packages were published through the npm accounts czirker and llxlr on June 24, 2026. The campaign steals a broad range of credentials including npm and GitHub tokens, cloud provider credentials, SSH keys, and AI coding assistant configurations. Attackers use GitHub repositories as dead-drop points and inject persistence hooks through orphan branches and fake dependency-update workflows. The presence of the RevokeAndItGoesKaboom marker links this activity to the earlier codfish/semantic-release-action compromise, indicating shared attacker tooling. No known exploits in the wild or official patches are currently documented.
Potential Impact
The campaign enables attackers to steal critical credentials from developer and CI/CD environments, including npm tokens, GitHub tokens, cloud provider credentials, SSH keys, and AI coding assistant configurations. This can lead to unauthorized access to source code repositories, cloud infrastructure, and developer tools, potentially resulting in further compromise of software supply chains and development environments. The use of GitHub as dead-drop infrastructure and persistence mechanisms increases the difficulty of detection and remediation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of official patches or advisories, organizations should audit their npm packages, GitHub Actions workflows, and Go modules for suspicious activity or unauthorized changes. Review and rotate exposed credentials such as npm tokens, GitHub tokens, cloud provider credentials, and SSH keys. Monitor for orphan branches and unusual dependency-update workflows in repositories. Follow updates from trusted sources and vendors regarding fixes or mitigations related to this campaign.
Indicators of Compromise
- hash: dbb9b09957113463bbeb420c2c4108b5
- hash: 7b0278216ac31ec18eca9eb8bc1c1261a1b26f6c
- hash: 927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f
- hash: ceff7c51d70832c3ec8dd2744b606a23b3c924ef664ae23439b9b742ea154108
- hash: 026588d39b7c650b5c0dfbba6c6fcc0e7ec8e3b72ba8639012e7f71c708f2c3b
- hash: 15b415ae41df72acf1f7e9e67569531d41dee62d089d34b4c0fab0c7fe5cc14f
- hash: 1a0e1daeaea87cab5610a3cc2aa72e7c6f1abfe55959a156368bcfa6585fa6ce
- hash: 1a3b9ed0b377f56f49b9a703612cf45e86ab7d100587e1e7a476d809fe337a8c
- hash: 32d1bc728d8e504952083a6adc488c309a401c7df4dc8f47b382ce32e4aebe21
- hash: 3da2ca129c9920d9acd2e3477aee8f46b5a5f0e9537ad6e7b6ab1df1007adad1
- hash: 4a0aa78757958683155a7b9289427fb829abcad1bf5ee6399eb73e8409b0bc11
- hash: 57ba86f6f0caaa580c1dccdf4ed7873d1470e5ea2f8e9ca7a989dc04899f13c0
- hash: 6a861a479f45fe53f067091414332248bc027ffc396116811d12e57a6ff71250
- hash: 6cb3fc3650355973b8a1ed86619a3f412fb0700f29c1c3a736cada4c2c76a9f7
- hash: 9f93d77d32833a515bc406c46da477142bb1ac2babeecb6aa42f98669a6db015
- hash: a934a5bcf692b9d01e8129bf264be23809dfee464df471d75a9f3fa1bcede343
- hash: b3e217f4354e8a4383038b99b0bcaeaff191a79df58e7a1f2355a79aac2faf13
- hash: df9ea0c71574e11c93141ad2f018a63a5375cd6d69ca2f744732ad7814170657
- hash: f565988f281bf77bcad26ea7f543617e53da4b62f5df63d4f7a89bae1729cf81
- hash: f7c47be306351ffacd46584d2067f7be676dbfe17cd89ab4880632decfe18f3d
Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem
Description
A sophisticated supply chain attack campaign linked to Mini Shai-Hulud, Miasma, and Hades malware has compromised LeoPlatform npm packages, GitHub Actions workflows, and the Verana Blockchain Go module. The attack employs binding.gyp install-time execution, Bun-staged JavaScript malware, and encrypted credential exfiltration targeting developer and CI/CD environments. Malicious packages were published through the czirker and llxlr npm accounts in a coordinated burst on June 24, 2026. The campaign steals credentials including npm tokens, GitHub tokens, cloud provider credentials, SSH keys, and AI coding assistant configurations. Attackers use GitHub as dead-drop infrastructure and inject persistence hooks into repositories through orphan branches and fake dependency-update workflows. The RevokeAndItGoesKaboom marker connects this wave to the codfish/semantic-release-action compromise, indicating shared operational tooling.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat involves a supply chain attack campaign attributed to malware families Mini Shai-Hulud, Miasma, and Hades. It targets LeoPlatform npm packages, GitHub Actions workflows, and the Verana Blockchain Go module. The attack vector includes install-time execution via binding.gyp, Bun-staged JavaScript malware, and encrypted exfiltration of developer and CI/CD credentials. Malicious packages were published through the npm accounts czirker and llxlr on June 24, 2026. The campaign steals a broad range of credentials including npm and GitHub tokens, cloud provider credentials, SSH keys, and AI coding assistant configurations. Attackers use GitHub repositories as dead-drop points and inject persistence hooks through orphan branches and fake dependency-update workflows. The presence of the RevokeAndItGoesKaboom marker links this activity to the earlier codfish/semantic-release-action compromise, indicating shared attacker tooling. No known exploits in the wild or official patches are currently documented.
Potential Impact
The campaign enables attackers to steal critical credentials from developer and CI/CD environments, including npm tokens, GitHub tokens, cloud provider credentials, SSH keys, and AI coding assistant configurations. This can lead to unauthorized access to source code repositories, cloud infrastructure, and developer tools, potentially resulting in further compromise of software supply chains and development environments. The use of GitHub as dead-drop infrastructure and persistence mechanisms increases the difficulty of detection and remediation.
Defensive Guidance
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of official patches or advisories, organizations should audit their npm packages, GitHub Actions workflows, and Go modules for suspicious activity or unauthorized changes. Review and rotate exposed credentials such as npm tokens, GitHub tokens, cloud provider credentials, and SSH keys. Monitor for orphan branches and unusual dependency-update workflows in repositories. Follow updates from trusted sources and vendors regarding fixes or mitigations related to this campaign.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"]
- Pulse Id
- 6a3df898a72c3bb83671b47b
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hashdbb9b09957113463bbeb420c2c4108b5 | — | |
hash7b0278216ac31ec18eca9eb8bc1c1261a1b26f6c | — | |
hash927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f | — | |
hashceff7c51d70832c3ec8dd2744b606a23b3c924ef664ae23439b9b742ea154108 | — | |
hash026588d39b7c650b5c0dfbba6c6fcc0e7ec8e3b72ba8639012e7f71c708f2c3b | — | |
hash15b415ae41df72acf1f7e9e67569531d41dee62d089d34b4c0fab0c7fe5cc14f | — | |
hash1a0e1daeaea87cab5610a3cc2aa72e7c6f1abfe55959a156368bcfa6585fa6ce | — | |
hash1a3b9ed0b377f56f49b9a703612cf45e86ab7d100587e1e7a476d809fe337a8c | — | |
hash32d1bc728d8e504952083a6adc488c309a401c7df4dc8f47b382ce32e4aebe21 | — | |
hash3da2ca129c9920d9acd2e3477aee8f46b5a5f0e9537ad6e7b6ab1df1007adad1 | — | |
hash4a0aa78757958683155a7b9289427fb829abcad1bf5ee6399eb73e8409b0bc11 | — | |
hash57ba86f6f0caaa580c1dccdf4ed7873d1470e5ea2f8e9ca7a989dc04899f13c0 | — | |
hash6a861a479f45fe53f067091414332248bc027ffc396116811d12e57a6ff71250 | — | |
hash6cb3fc3650355973b8a1ed86619a3f412fb0700f29c1c3a736cada4c2c76a9f7 | — | |
hash9f93d77d32833a515bc406c46da477142bb1ac2babeecb6aa42f98669a6db015 | — | |
hasha934a5bcf692b9d01e8129bf264be23809dfee464df471d75a9f3fa1bcede343 | — | |
hashb3e217f4354e8a4383038b99b0bcaeaff191a79df58e7a1f2355a79aac2faf13 | — | |
hashdf9ea0c71574e11c93141ad2f018a63a5375cd6d69ca2f744732ad7814170657 | — | |
hashf565988f281bf77bcad26ea7f543617e53da4b62f5df63d4f7a89bae1729cf81 | — | |
hashf7c47be306351ffacd46584d2067f7be676dbfe17cd89ab4880632decfe18f3d | — |
Threat ID: 6a3e3c494853345fc18a5bb2
Added to database: 06/26/2026, 08:46:01 UTC
Last enriched: 06/26/2026, 09:01:28 UTC
Last updated: 09/24/2026, 11:15:23 UTC
Views: 224
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.