# Evolving Shai-Hulud Campaign: Miasma Malware Expands Beyond npm to Go Ecosystem Through Supply Chain Attacks
Cybersecurity researchers have identified yet another evolution of the supply chain attack operation linked to the Mini Shai-Hulud, Miasma, and Hades malware family. The latest wave has compromised a significant new set of npm packages and, notably, has crossed into the Go ecosystem for the first time, demonstrating the campaign’s continued expansion across legitimate software ecosystems.
## Scope of the Latest Campaign
According to security firm Socket, the most recent malicious activity includes rogue npm releases targeting the LeoPlatform and RStreams packages, abuse of GitHub Actions workflows, and a related Go module compromise involving the Verana Blockchain project. The overarching objective remains consistent with prior iterations: harvesting developer and maintainer credentials and weaponizing the stolen data to propagate further across package registries, code repositories, and trusted developer workflows.
The compromised packages include:
– hexo-deployer-wrangler@1.0.4
– hexo-shoka-swiper@0.1.10
– leo-auth@4.0.6
– leo-aws@2.0.4
– leo-cache@1.0.2
– leo-cdk-lib@0.0.2
– leo-cli@3.0.3
– leo-config@1.1.1
– leo-connector-elasticsearch@2.0.6
– leo-connector-mongo@3.0.8
– leo-connector-mysql@3.0.3
– leo-connector-oracle@2.0.1
– leo-connector-redshift@3.0.6
– leo-cron@2.0.2
– leo-logger@1.0.8
– leo-sdk@6.0.19
– leo-streams@2.0.1
– prism-silq@1.0.1
– rstreams-metrics@2.0.2
– rstreams-shard-util@1.0.1
– serverless-convention@2.0.4
– serverless-leo@3.0.14
– solo-nav@1.0.1
– github.com/verana-labs/verana-blockchain@v0.10.1-dev.20 (Go)
## Entry Point: Breached npm Developer Account
Researchers suspect that an npm developer account associated with the LeoPlatform ecosystem, registered under the username “czirker,” was compromised through leaked credentials. This breach provided the threat actors with an npm token belonging to the package maintainer, enabling them to push trojanized versions to the registry within a remarkably narrow six-second window.
## Attack Techniques and Malware Capabilities
The new wave leverages many of the sophisticated tactics previously observed across earlier campaign iterations:
– **npm registry poisoning**
– **binding.gyp install-time execution** for arbitrary code execution during package installation
– **Bun-staged JavaScript malware** that downloads and installs the Bun runtime if not present on the target system
– **GitHub dead-drop infrastructure** for command-and-control operations
– **GitHub Actions secret theft** to capture CI/CD environment secrets from runner memory
– **IDE and AI coding assistant persistence** mechanisms
– **Encrypted credential exfiltration**
Notably, the malicious npm packages lack a traditional lifecycle hook in their package.json file. Instead, they incorporate a `binding.gyp` file to execute arbitrary code during the installation process. This triggers the launch of a JavaScript loader, which first checks for the presence of the Bun runtime and installs it if missing, then initiates the stealer payload responsible for harvesting secrets, credentials, and tokens from the compromised system.
The malware includes a Russian locale killswitch and performs checks for the presence of endpoint security software prior to executing its payload. Additionally, it deploys a GitHub Actions workflow named “Run Copilot” designed to capture CI/CD environment secrets from runner memory. The exfiltrated data is then uploaded to a public GitHub repository with the description “Alright Lets See If This Works.” As of the time of reporting, 559 repositories matching this description were identified.
## Changes to the Token Relay Marker
The latest iteration has also introduced a change in the token relay marker used as a security deterrent. Earlier campaign waves employed the string “IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner.” The current artifact now uses “RevokeAndItGoesKaboom” — a string that has been independently linked to the dead-drop resolver associated with the recent compromise of the “codfish/semantic-release-action” GitHub Action.
## Connection to the codfish/semantic-release-action Compromise
Security company StepSecurity confirmed that on June 24, 2026, at 15:39:06 UTC, an attacker force-pushed a malicious commit to the codfish/semantic-release-action repository and redirected several version tags to point at the compromised commit. Any workflow that executed against one of these redirected tags after that timestamp ran the attacker’s payload directly inside the GitHub Actions runner. The payload subsequently:
– Stole GitHub OIDC tokens
– Harvested Personal Access Tokens matching known GitHub token patterns
– Encrypted the collected material using AES-128-GCM
– Attempted to propagate a backdoor into other repositories accessible with the stolen credentials
This pattern strongly indicates that all of these events are linked to the same operational cluster or tooling lineage.
## Malware Polling Mechanism
According to Endor Labs and OX Security, the malware also actively polls GitHub every hour, searching for commits matching the string “firedalazer.” When a matching commit is found, the malware retrieves and executes the Hades variant of the payload, enabling dynamic updates and command-and-control through a public platform.
## Cross-Ecosystem Expansion to Go
The compromise of the Verana Blockchain project marks a significant expansion of the campaign beyond the npm ecosystem into Go. However, the attack employs the same Miasma execution pattern observed in the malicious npm packages, without relying on native Go module resolution or build logic.
Socket explained that unlike the npm packages, the Go sample does not depend on `binding.gyp`. Instead, the risk lies in source-repository execution: a developer who clones or opens the repository in a trusted IDE or AI coding assistant environment may inadvertently trigger the payload through project configuration.
## Broader Implications
JFrog noted that the Leo/RStreams package set is tied to cloud-native and serverless workloads, meaning a compromise in this ecosystem can expose developer workstations, CI/CD systems, AWS-backed applications, GitHub repositories, package publishing credentials, and downstream package consumers.
Security researchers emphasized that the most significant aspect of this campaign is not that the payload introduces radically new techniques, but rather that Shai-Hulud continues to move across legitimate package ecosystems while changing just enough indicators to render stale detections less effective. The campaign’s core theme remains consistent: Miasma is moving across package ecosystems by targeting developer workflows broadly, not merely package-manager install hooks.
—
*Original article source: [https://blogger.googleusercontent.com/ – Miasma Supply Chain Attack](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhatZ2Vkvxd086INLXiuhbRJrli5Ao9hoNajbVq-Xr0HVAS70cCzhRBfM78KEusnBPI1sXyAK5tYrKt55U5mTIXCQDAmBzY2e860qtXo4YAlvAnVWHDV3DddKUML1q1g71h97Ke1i-714gv5SaVW9lmaFNtRda5XP1kc20urtc-HzlX5JXwkQv0g_-1VwC3/s1600/Miasma.jpg)*
