{
  "name": "Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem",
  "slug": "mini-shai-hulud-hits-leoplatform-npm-packages-and-github-actions-expands-to-the-go-ecosystem",
  "description": "A sophisticated supply chain attack campaign linked to Mini Shai-Hulud, Miasma, and Hades malware has compromised LeoPlatform npm packages, GitHub Actions workflows, and the Verana Blockchain Go module. The attack employs binding.gyp install-time execution, Bun-staged JavaScript malware, and encrypted credential exfiltration targeting developer and CI/CD environments. Malicious packages were published through the czirker and llxlr npm accounts in a coordinated burst on June 24, 2026. The campaign steals credentials including npm tokens, GitHub tokens, cloud provider credentials, SSH keys, and AI coding assistant configurations. Attackers use GitHub as dead-drop infrastructure and inject persistence hooks into repositories through orphan branches and fake dependency-update workflows. The RevokeAndItGoesKaboom marker connects this wave to the codfish/semantic-release-action compromise, indicating shared operational tooling.",
  "published": "2026-06-26T03:57:12.313000+00:00",
  "created_at": "2026-06-26T08:41:53.257000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-06-26T08:41:53.257000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "bun runtime",
    "hades",
    "leoplatform",
    "miasma",
    "mini shai-hulud",
    "npm packages",
    "supply chain attack"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "bac19957-b73c-4cd1-98fa-1014f5567225",
        "name": "57ba86f6f0caaa580c1dccdf4ed7873d1470e5ea2f8e9ca7a989dc04899f13c0"
      },
      {
        "id": "23c67d65-3806-459d-ac62-aa404dc08a46",
        "name": "15b415ae41df72acf1f7e9e67569531d41dee62d089d34b4c0fab0c7fe5cc14f"
      },
      {
        "id": "f43e92f4-cfd5-4846-bf5e-2a42f634e7eb",
        "name": "1a3b9ed0b377f56f49b9a703612cf45e86ab7d100587e1e7a476d809fe337a8c"
      },
      {
        "id": "f45bc145-4a38-480c-99d9-26968700fa86",
        "name": "32d1bc728d8e504952083a6adc488c309a401c7df4dc8f47b382ce32e4aebe21"
      },
      {
        "id": "f981e991-4c25-4650-ac08-c143086b75a1",
        "name": "3da2ca129c9920d9acd2e3477aee8f46b5a5f0e9537ad6e7b6ab1df1007adad1"
      },
      {
        "id": "2d32394b-ff87-457f-85d6-88d4be553f22",
        "name": "6cb3fc3650355973b8a1ed86619a3f412fb0700f29c1c3a736cada4c2c76a9f7"
      },
      {
        "id": "463b20f7-c26f-4b09-b29e-65f981c2a74f",
        "name": "f7c47be306351ffacd46584d2067f7be676dbfe17cd89ab4880632decfe18f3d"
      },
      {
        "id": "075dfa48-b37e-4952-9f0a-8f3b33b27930",
        "name": "f565988f281bf77bcad26ea7f543617e53da4b62f5df63d4f7a89bae1729cf81"
      },
      {
        "id": "a14a99ac-34c7-48d6-9123-b6e1db324cac",
        "name": "1a0e1daeaea87cab5610a3cc2aa72e7c6f1abfe55959a156368bcfa6585fa6ce"
      },
      {
        "id": "d8a3a5f6-c6e2-4292-a3ed-e0b9f929dcf7",
        "name": "ceff7c51d70832c3ec8dd2744b606a23b3c924ef664ae23439b9b742ea154108"
      },
      {
        "id": "cad5a46b-7c06-40b6-b694-e63031e36849",
        "name": "4a0aa78757958683155a7b9289427fb829abcad1bf5ee6399eb73e8409b0bc11"
      },
      {
        "id": "419a722d-c6ec-4104-be5f-cdea77e430f6",
        "name": "b3e217f4354e8a4383038b99b0bcaeaff191a79df58e7a1f2355a79aac2faf13"
      },
      {
        "id": "a1f12c19-7324-4312-914c-e5ddcc0c9159",
        "name": "9f93d77d32833a515bc406c46da477142bb1ac2babeecb6aa42f98669a6db015"
      },
      {
        "id": "a3367c89-810f-4bfc-9b47-8b93bdb66a45",
        "name": "a934a5bcf692b9d01e8129bf264be23809dfee464df471d75a9f3fa1bcede343"
      },
      {
        "id": "147279b4-3be7-433d-85b2-86de93305816",
        "name": "df9ea0c71574e11c93141ad2f018a63a5375cd6d69ca2f744732ad7814170657"
      },
      {
        "id": "adb709f3-eaab-41fe-8ee2-8d1cf99c43ee",
        "name": "6a861a479f45fe53f067091414332248bc027ffc396116811d12e57a6ff71250"
      },
      {
        "id": "97f42e11-1d26-4dcf-96ab-dd151f4860c8",
        "name": "026588d39b7c650b5c0dfbba6c6fcc0e7ec8e3b72ba8639012e7f71c708f2c3b"
      },
      {
        "id": "69730c87-09e3-4c1a-907c-790dd8b44a99",
        "name": "927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f"
      }
    ],
    "malware": [
      {
        "id": "7f348e4a-a1c1-4851-be94-d8dbf0f08496",
        "name": "Mini Shai-Hulud",
        "slug": "mini-shai-hulud"
      },
      {
        "id": "c97eecb2-46dd-4e3b-8b82-906269d7cb83",
        "name": "Hades",
        "slug": "hades"
      },
      {
        "id": "2f504a89-03b5-446f-9820-2df5e962a0d1",
        "name": "Miasma",
        "slug": "miasma"
      }
    ]
  },
  "external_refs": [
    {
      "id": "e39c60fe-b662-4643-9e85-c8d8df0fbbb9",
      "standard_id": "external-reference--82055822-29a6-5f99-a360-bc32256160ff",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a3df898a72c3bb83671b47b",
      "hash": null,
      "external_id": "6a3df898a72c3bb83671b47b",
      "created": "2026-06-26T08:41:50.053Z",
      "modified": "2026-06-26T08:41:50.053Z",
      "createdById": null
    },
    {
      "id": "1d89f925-ed58-491e-b587-72f294c0b617",
      "standard_id": "external-reference--f48bcc1a-78a2-515b-847f-4abab6c72149",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem",
      "hash": null,
      "external_id": null,
      "created": "2026-06-26T08:41:50.166Z",
      "modified": "2026-06-26T08:41:50.166Z",
      "createdById": null
    }
  ]
}