Leo Platform npm Supply Chain Attack (June 2026)
Summary
On June 24, 2026, 20 npm packages belonging to the Leo Platform (LeoPlatform/LeoInsights) ecosystem were simultaneously compromised via a single hijacked maintainer account, delivering a credential-stealing worm structurally identical to the earlier Miasma campaign. The attack is attributed to tooling derived from the TeamPCP Shai-Hulud worm framework, which was open-sourced on May 12, 2026, enabling copycat or original-actor operations against new ecosystems. Approximately 13,600 weekly downloads were exposed to a payload capable of stealing CI/CD secrets, cloud credentials, cryptocurrency wallet files, and AI coding-tool configurations.
Connected Entities
1 entities · 10 linked investigationsTimeline(9 events)
2025-01-01
TeamPCP begins active supply chain attack campaigns targeting npm and PyPI ecosystems using the Shai-Hulud worm framework (approximate start based on reporting).
Datadog Security Labs2026-04-13
Credentials belonging to a Red Hat employee appear in commercial infostealer logs — the earliest known precursor to the subsequent Miasma campaign.
Microsoft Security Blog2026-05-12
TeamPCP open-sources the Shai-Hulud worm framework on GitHub under MIT License with the message 'Shai-Hulud: Open Sourcing The Carnage,' enabling potential copycat operations.
Datadog Security Labs2026-06-01
Miasma first wave: malicious commits pushed to three @redhat-cloud-services repositories at 10:53 UTC.
Wiz Blog2026-06-03
Miasma campaign publicly confirmed: 32 @redhat-cloud-services npm packages compromised across 57 packages and 286 malicious versions using the Phantom Gyp technique.
Miasma Supply Chain Attack - The Hacker News2026-06-05
IronWorm campaign disclosed: 50+ npm packages trojanized via compromised 'asteroiddao' npm account, including Exodus cryptocurrency wallet file theft.
The Hacker News2026-06-24
Orphan branches created on Leo Platform GitHub repositories at approximately 22:50 UTC, containing weaponized Dependabot workflow files requesting OIDC publishing permissions.
SafeDep2026-06-24
At 23:04:55 UTC, 20 malicious npm package versions published across the Leo Platform ecosystem in a 3-second burst using the compromised czirker maintainer account.
StepSecurity2026-06-25
Public disclosure by StepSecurity and SafeDep; GBHackers reports attack as Shai-Hulud Hades Payload targeting Leo/RStreams packages.
GBHackersDecision Log
- hash: GM3BvCBEaBtWT2BEnYjibxKJMBiC1D4gPWrRCWq9nZgQ
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/25/2026, 5:03:56 PM
last updated: 6/25/2026, 5:04:05 PM
avoid.net — verified advice for a post-truth world