Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
Summary: Researchers flagged a new wave of the Mini Shai-Hulud, Miasma, and Hades malware family that compromised LeoPlatform and RStreams npm packages, abused GitHub Actions workflows, and reached a Go module in the Verana Blockchain project, with an npm account tied to LeoPlatform suspected breached via leaked credentials and its maintainer token used to push trojanized versions within a six-second window. The packages use a binding.gyp file to run code at install time, launch a Bun-staged JavaScript loader and credential stealer, and drop a workflow named "Run Copilot" to capture CI/CD secrets, while a June 24, 2026 force-push to codfish/semantic-release-action and a June 26, 2026 publishing of @immobiliarelabs Backstage plugin versions within a 30-second window point to one operational cluster.
What you should know: The attacker needed six seconds to publish malicious npm versions and 30 seconds to insert compromised @immobiliarelabs releases into every supported major series at once, so a maintainer credential leak can outrun any review step that depends on a human noticing.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026