Post
Back to narratives
SecurityActive
Conversation intelligence
Shai-Hulud/Miasma malware variant attacks npm packages from LeoPlatform
A new variant of the Shai-Hulud/Miasma malware compromised 20-23 npm packages from the LeoPlatform project, affecting over 50,000 monthly downloads. The attack uses a binding.gyp file to bypass lifecycle script scanners and steals credentials for GitHub, npm, cloud services, and AI coding tools.
Heat
86
Confidence
95%
Evidence
7
Updated
Why It Happened
The compromised npm developer account 'czirker' was used to publish malicious packages that execute during npm install via a preconfigured binding.gyp file, enabling credential theft and further supply chain compromise.
Outcome So Far
Affected packages identified and published in security reports; 338–408 GitHub repositories found with stolen credentials so far. Mitigation steps are being shared by security firms.
Actors
CZczirkercompromised npm developer account
LELeoPlatformaffected project
Timeline order
Post
Post
Parent event 02
safedepio notes Miasma worm's bypass technique
safedepio tweet explains Miasma worm used binding.gyp instead of postinstall to bypass lifecycle script scanners; targets multiple ecosystems.
Related posts@JFrogSecurity@MosheTov@safedepio5 posts