Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised

1. Executive summary

On 2026-06-24, an attacker published malicious versions of 20 npm packages in the Leo Platform ecosystem in a coordinated burst spanning less than three seconds (all published at 2026-06-24T23:04:55Z). All 20 packages carry an identical CI/CD attack toolkit that steals secrets from GitHub Actions runners, cloud credential stores, package registries, and password managers, then exfiltrates them via the victim's own GitHub token — no external attacker-controlled domain is contacted. The packages collectively receive approximately 13,600 downloads per week. The attack is structurally identical to the "Miasma" campaign documented on 2026-06-03 (57 npm packages, 286+ versions), sharing the same binding.gyp hook syntax, three-layer obfuscation chain, and Bun v1.3.13 download URL; attribution to the same threat actor is assessed as likely but unconfirmed — no MITRE actor profile has been resolved for this item. EMEA financial services with CI/CD pipelines consuming any of the 20 affected packages are at immediate risk of credential theft, lateral supply-chain compromise, and downstream code-p integrity loss.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Initial access — maintainer credential compromise. An unauthorised actor gained access to Leo Platform maintainer credentials (method not specified in source). Using those credentials, the attacker published malicious versions of 20 packages in a single automated operation.
2. Coordinated publish. All 20 packages were published within a 3-second window at 2026-06-24T23:04:55Z, confirming a single automated operation. The 20 affected packages and their confirmed malicious versions are listed in §5 (IOCs).
3. Delivery — binding.gyp install hook ("Phantom Gyp"). The payload fires via a binding.gyp file using node-gyp <!(...) shell expansion inside the sources array. This executes arbitrary commands at install time without declaring any entry in the scripts block of package.json. Any package shipping a binding.gyp with no C++ sources and no .node binary output is suspicious.
4. Obfuscation chain. Three layers: ROT-N cipher → AES-128-GCM → obfuscator.io. The payload also performs Bun runtime evasion and downloads Bun v1.3.13 from a specific URL (the exact URL is referenced in the source but not quoted verbatim — single-sourced; verify before enforcement).
5. Runner process memory extraction. The payload locates the GitHub Actions Runner.Worker process via /proc/{pid}/cmdline, then reads /proc/{pid}/mem directly to recover secrets that are masked in workflow logs and invisible to child processes.
6. Multi-cloud credential sweep. The payload harvests credentials from: - AWS: IMDS, Secrets Manager, SSM, ECS - GCP: metadata service, service account keys - Azure: managed identity, Key Vault, federated credentials - HashiCorp Vault: 10+ token file locations - Kubernetes: service account token - Package registries: npm, PyPI, RubyGems, JFrog - GitHub PATs - 1Password
7. GitHub dead-drop exfiltration. Stolen credentials are encrypted and committed to GitHub repositories via the GitHub GraphQL API using the victim's own token. No external attacker-controlled domain is contacted — this makes network-based detection difficult.
8. Supply-chain worm. If an npm token is found, the payload publishes malicious versions of any package the victim has publish rights to via the bypass_2fa API mechanism, without triggering two-factor authentication. This enables autonomous lateral propagation across the npm ecosystem.

Connection to Miasma campaign (single-sourced; verify before enforcement)

Step Security assesses this operation as structurally identical to the "Miasma" campaign published 2026-06-03, which compromised 57 npm packages across 286+ versions. Shared fingerprints: binding.gyp hook syntax, Bun v1.3.13 download URL, three-layer obfuscation structure. The Leo Platform operation is more targeted (single ecosystem vs. carpet-bombing) and faster (3-second publish window vs. under 2 hours). Attribution to the same threat actor is likely but unconfirmed — no MITRE actor profile has been resolved. The earlier Red Hat Cloud Services npm compromise (corpus-1, corpus-2) used a similar multi-stage credential harvester targeting GitHub Actions secrets, AWS, GCP, Azure, Kubernetes, HashiCorp Vault, npm tokens, and CircleCI tokens, and has been linked to "Mini Shai-Hulud" malware by Wiz Security (corpus-2) — the relationship between Mini Shai-Hulud and the Miasma/Leo Platform toolkit is not established in the provided sources.

Packages fully analysed: leo-logger@1.0.8 (full analysis), leo-sdk@6.0.19 (spot-checked to confirm campaign scope).

Observed impact: Approximately 13,600 downloads per week across the 20 packages. The number of installs that executed the payload (vs. registry mirrors, CI caches, or aborted installs) is not specified.

4. Mitigation & containment

P1 — Within 24 hours

1. Identify exposure. Search all package-lock.json, yarn.lock, pnpm-lock.yaml, and npm-shrinkwrap.json files across all repositories and CI/CD environments for any of the 20 affected package names listed in §5. Run: bash grep -rE "leo-logger|leo-sdk|leo-auth|leo-config|leo-core|leo-db|leo-redis|leo-queue|leo-events|leo-http|leo-utils|leo-types|leo-errors|leo-middleware|leo-router|leo-plugin|leo-test|leo-cli|leo-api|leo-server" --include="package-lock.json" --include="yarn.lock" --include="pnpm-lock.yaml" . Then check the resolved version against the malicious versions listed in §5.
2. Block and quarantine. If any affected package/version is found in a CI/CD pipeline: - Immediately rotate ALL credentials accessible to that runner: GitHub PATs, AWS keys, GCP service account keys, Azure managed identity federated credentials, HashiCorp Vault tokens, npm tokens, PyPI tokens, RubyGems tokens, JFrog tokens, Kubernetes service account tokens, and 1Password vault credentials. - Revoke and regenerate any npm publish tokens associated with accounts that have publish rights to any npm package. - Audit GitHub repositories for unexpected commits (the dead-drop exfiltration commits credentials to GitHub repos via GraphQL API). Check commit history for commits not authored by known team members.
3. Block Bun v1.3.13 download. If the payload's Bun download URL is present in network logs or egress proxy logs, block it at the firewall/proxy. (The exact URL is referenced in the source but not quoted verbatim — single-sourced; verify before enforcement.)
4. Pin or remove affected packages. If functionality is required, pin to the last known-good version (the version immediately before the malicious one). If not required, remove the dependency entirely.

**P2 — Within 72 hours:

5. Audit CI/CD runner memory access. The payload reads /proc/{pid}/mem directly. Harden runners by: - Running build jobs in containers with restricted /proc access (e.g., --security-opt no-new-privileges, seccomp profiles that deny ptrace). - Using ephemeral, isolated runners that are destroyed after each job. - Ensuring GitHub Actions secrets are not available to npm install steps (use environment separation; do not expose secrets to dependency-installation steps).
6. Review npm publish 2FA. The payload exploits a bypass_2fa API mechanism. Ensure all npm accounts with publish rights have 2FA enforced for publish. Audit whether any packages under your organisation's npm scope were targeted by the supply-chain worm (check for unexpected version publishes).
7. Scan for binding.gyp anomalies. Across all npm dependencies, identify packages that ship a binding.gyp file but have no C++ sources and no .node binary output: bash find node_modules -name "binding.gyp" -exec sh -c 'dir=$(dirname "{}"); if [ ! -f "$dir/*.cc" ] && [ ! -f "$dir/*.cpp" ] && [ ! -f "$dir/*.node" ]; then echo "SUSPICIOUS: {}"; fi' \;

**P3 — Within 7 days:

8. Implement dependency provenance verification. Use npm's provenance features (or npm v12 security changes when available — corpus-3) to verify package integrity at install time. Pin all dependencies to specific versions via lockfiles and enforce lockfile integrity in CI.
9. Post-incident review. If credentials were exfiltrated, conduct a full audit of all systems accessible via those credentials. Assume the attacker has persistent access until credentials are rotated and access logs are reviewed. Document the incident under DORA Art. 17/18/19 or NIS2 Art. 23 as applicable.
10. Monitor for follow-on packages. Given the supply-chain worm capability, monitor npm for new malicious versions of packages owned by any npm account whose token was accessible to an affected runner.

5. Indicators of compromise

Note: The source names 20 affected packages but only explicitly lists leo-logger@1.0.8 and leo-sdk@6.0.19 with versions. The remaining 18 package names and versions are not quoted in the provided source material. Do not assume package names not present in the source.

package  leo-logger@1.0.8
package  leo-sdk@6.0.19
timestamp  2026-06-24T23:04:55Z
file  binding.gyp
technique  node-gyp <!(...) shell expansion in sources array
obfuscation  ROT-N cipher -> AES-128-GCM -> obfuscator.io
runtime  Bun v1.3.13
process  Runner.Worker
filepath  /proc/{pid}/cmdline
filepath  /proc/{pid}/mem
api  GitHub GraphQL API
api_mechanism  bypass_2fa
credential_target  AWS IMDS
credential_target  AWS Secrets Manager
credential_target  AWS SSM
credential_target  AWS ECS
credential_target  GCP metadata service
credential_target  GCP service account keys
credential_target  Azure managed identity
credential_target  Azure Key Vault
credential_target  Azure federated credentials
credential_target  HashiCorp Vault token files (10+ locations)
credential_target  Kubernetes service account token
credential_target  npm tokens
credential_target  PyPI tokens
credential_target  RubyGems tokens
credential_target  JFrog tokens
credential_target  GitHub PATs
credential_target  1Password

6. Detection

rule Leo_Platform_NPM_Supply_Chain_Payload {
    meta {
        author = "Adverse Trace"
        date = "2026-06-25"
        reference = "https://www.stepsecurity.io/blog/mass-npm-supply-chain-attack-20-leo-platform-packages-compromised"
        description = "Detects the Phantom Gyp / Miasma-family CI/CD credential harvester delivered via binding.gyp in Leo Platform npm packages"
    }
    strings:
        $gyp_hook = "binding.gyp" ascii
        $shell_expansion = "<!(" ascii
        $sources_array = "sources" ascii
        $runner_worker = "Runner.Worker" ascii
        $proc_cmdline = "/proc/" ascii
        $proc_mem = "/mem" ascii
        $graphql = "graphql" ascii nocase
        $bypass_2fa = "bypass_2fa" ascii
        $bun_version = "bun-v1.3.13" ascii nocase
        $obfuscator_io = "obfuscator.io" ascii nocase
        $aes_gcm = "aes-128-gcm" ascii nocase
        $rot_n = "rot" ascii nocase
        $imds = "imds" ascii nocase
        $vault_token = "vault" ascii nocase
        $key_vault = "keyvault" ascii nocase
        $service_account = "service-account" ascii nocase
        $1password = "1password" ascii nocase
        $npm_token = "npm" ascii nocase
        $pypi = "pypi" ascii nocase
        $rubygems = "rubygems" ascii nocase
        $jfrog = "jfrog" ascii nocase
        $circleci = "circleci" ascii nocase
    condition:
        8 of them
}

title: Detect Phantom Gyp binding.gyp Install Hook Execution in CI/CD
id: at-2026-06-25-177-sigma-1
status: experimental
description: Detects npm install triggering shell commands via binding.gyp <!(...) expansion, consistent with the Leo Platform / Miasma campaign payload delivery
references:

  - https://www.stepsecurity.io/blog/mass-npm-supply-chain-attack-20-leo-platform-packages-compromised
author: Adverse Trace
date: 2026/06/25
logsource:
    product: linux
    category: process_creation
detection:
    selection_process:
        Image|endswith:

            - "/node"
            - "/npm"
            - "/node-gyp"
        CommandLine|contains:

            - "npm install"
    selection_gyp:
        CommandLine|contains:

            - "binding.gyp"
    selection_shell_expansion:
        CommandLine|contains:

            - "<!("
    condition: selection_process and (selection_gyp or selection_shell_expansion)
falsepositives:

    - Legitimate native Node.js addons that use node-gyp with C++ sources (verify presence of .cc/.cpp files)
level: high

title: Detect GitHub Actions Runner.Worker Process Memory Read
id: at-2026-06-25-177-sigma-2
status: experimental
description: Detects a process reading /proc/{pid}/mem targeting the GitHub Actions Runner.Worker process, consistent with the Leo Platform credential harvester
references:

  - https://www.stepsecurity.io/blog/mass-npm-supply-chain-attack-20-leo-platform-packages-compromised
author: Adverse Trace
date: 2026/06/25
logsource:
    product: linux
    category: file_access
detection:
    selection_target:
        TargetFilename|contains:

            - "/proc/"
            - "/mem"
    selection_cmdline:
        CommandLine|contains:

            - "Runner.Worker"
    condition: selection_target and selection_cmdline
falsepositives:

    - Legitimate debugging or monitoring tools accessing runner process memory (rare in CI/CD)
level: critical

title: Detect npm bypass_2fa API Call for Package Publishing
id: at-2026-06-25-177-sigma-3
status: experimental
description: Detects network traffic or process command lines referencing the npm bypass_2fa API mechanism, consistent with the supply-chain worm capability in the Leo Platform campaign
references:

  - https://www.stepsecurity.io/blog/mass-npm-supply-chain-attack-20-leo-platform-packages-compromised
author: Adverse Trace
date: 2026/06/25
logsource:
    product: linux
    category: network_connection
detection:
    selection:
        CommandLine|contains:

            - "bypass_2fa"
    condition: selection
falsepositives:

    - Unknown — this API mechanism is not part of normal npm publish workflows
level: critical

7. Sources

• Step Security — Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised — https://www.stepsecurity.io/blog/mass-npm-supply-chain-attack-20-leo-platform-packages-compromised — 2026-06-25
• Step Security — Multiple redhat-cloud-services npm Packages compromised — https://www.stepsecurity.io/blog/multiple-redhat-cloud-services-npm-packages-compromised — (date not specified)
• Help Net Security — Red Hat npm packages compromised in new Mini Shai-Hulud malware wave — https://www.helpnetsecurity.com/2026/06/02/red-hat-npm-packages-compromised-mini-shai-hulud/ — 2026-06-02
• BleepingComputer — GitHub announces npm security changes to tackle supply-chain attacks — https://www.bleepingcomputer.com/news/security/github-announces-npm-security-changes-to-tackle-supply-chain-attacks/ — (date not specified)

8. Adverse Trace position

This is a high-severity supply-chain compromise for any EMEA financial institution whose CI/CD pipelines consume Leo Platform npm packages. The payload is a full-spectrum credential harvester with autonomous lateral-propagation capability (supply-chain worm via bypass_2fa), and the GitHub dead-drop exfiltration mechanism makes network-based detection ineffective — stolen credentials leave via the victim's own authenticated GitHub session, not an attacker-controlled endpoint. The structural identity with the Miasma campaign (same binding.gyp hook, same obfuscation chain, same Bun URL) strongly suggests a single, capable, and persistent threat actor; however, attribution remains unconfirmed as no MITRE actor profile has been resolved. The source is single-sourced (Step Security only); we assess the technical detail as credible and internally consistent, but clients should verify the full 20-package list and the Bun download URL before enforcing blocklists. Adverse Trace will: (a) monitor for the remaining 18 package names and versions if published by Step Security or corroborated by a second source; (b) track any follow-on packages published by the supply-chain worm; (c) watch for npm v12 security features (corpus-3) that may mitigate binding.gyp install-hook abuse; and (d) update this advisory if attribution is confirmed or if additional IOCs emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.