A new, particularly worrying development in the global software supply chain has been uncovered by cybersecurity researchers, identifying yet another wave of attacks linked to the Mini Shai-Hulud, Miasma, and Hades. The new campaign is no longer limited to the JavaScript npm ecosystem, but has also expanded to the Go, demonstrating that the perpetrators are constantly expanding the scope of their operations.
According to Socket, the attackers have infected new npm packages related to the LeoPlatform and RStreams, while also compromising Go modules associated with the Verana blockchain project.
The affected packages are:
- hexo-deployer-wrangler@1.0.4
- hexo-shoka-swiper@0.1.10
- leo-auth@4.0.6
- leo-aws@2.0.4
- leo-cache@1.0.2
- leo-cdk-lib@0.0.2
- leo-cli@3.0.3
- leo-config@1.1.1
- leo-connector-elasticsearch@2.0.6
- leo-connector-mongo@3.0.8
- leo-connector-mysql@3.0.3
- leo-connector-oracle@2.0.1
- leo-connector-redshift@3.0.6
- leo-cron@2.0.2
- leo-logger@1.0.8
- leo-sdk@6.0.19
- leo-streams@2.0.1
- prism-silq@1.0.1
- rstreams-metrics@2.0.2
- rstreams-shard-util@1.0.1
- serverless-convention@2.0.4
- serverless-leo@3.0.14
- solo-nav@1.0.1
- github.com/verana-labs/verana-blockchain@v0.10.1-dev.20 (Go)
See also: Miasma: New supply chain attack compromises Red Hat npm packages
The real target is developer credentials
Unlike traditional attacks that directly target organizations or end users, this particular campaign seeks something much more strategic: stealing the credentials of software developers and maintainers.
Through the stolen credentials, the attackers can publish infected package versions to trusted repositories, gain access to GitHub accounts, and extend their presence across entire software development chains.
This method is particularly dangerous, as developers trust thousands of open source libraries every day. Even a small, popular package can act as a "Trojan Horse" and carry malicious code to hundreds or even thousands of applications.
How the new Miasma attack was carried out
Analysts believe the attack began after an npm account associated with LeoPlatform was compromised. The attackers appear to have gained access through a credential leak and used the maintainer's token to push modified versions of packages within a span of just six seconds.
The new wave of attacks leverages several of the techniques seen in previous Mini Shai-Hulud campaigns. These include npm registry poisoning, binding.gyp install-time execution, abuse of GitHub Actions, installation of malicious JavaScript code, and covert extraction of credentials and secret environment variables.
Binding.gyp becomes a vehicle for installing malicious code
One of the most interesting elements of the attack is that the infected packets do not use the usual lifecycle hooks that are more easily detected by security tools.
See also: DAEMON Tools Supply Chain Attack: Government organizations targeted
Instead, they embed a binding.gyp, which allows arbitrary code execution during package installation. This stage triggers a JavaScript loader that installs the Bun runtime, if it is not already present on the system, and then executes the payload that collects credentials, API keys, and other sensitive information.
The malware even has a "killswitch" mechanism for Russian locales, while also checking for endpoint protection tools before continuing its activity.
CI/CD environments also in the spotlight
The attack takes on even greater severity because it directly targets CI/CD environments and automated software development processes.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The malware installs a malicious workflow called “Run Copilot,” which attempts to collect environment secrets from GitHub runners. The data is then uploaded to public GitHub repositories using a seemingly innocent description. Experts point out that this approach is particularly dangerous, as CI/CD environments often contain credentials for cloud services, application signing keys, and access rights to production systems.
Extending in Go changes the data
The new breach involving the Verana Blockchain proves that the campaign is no longer limited exclusively to npm.
Although the Go version does not use binding.gyp, it follows the same pattern as Miasma, attempting to exploit development environments and code assistance tools. A developer who clones the repository or opens it in a trusted IDE may inadvertently activate the malicious payload.
See also: TrapDoor: Supply Chain Attack on npm, PyPI and CratesIO
This development highlights a broader shift in the philosophy of software supply chain attacks. Cybercriminals are no longer targeting just package managers and installation hooks, but the daily workflows of developers themselves. As organizations increasingly rely on open source and automated development processes, protecting the software supply chain is emerging as one of the greatest cybersecurity challenges of the modern digital age.
