Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack

1. Executive summary

A new wave of the Miasma/Mini Shai-Hulud supply-chain malware family has compromised at least 24 npm packages (LeoPlatform, RStreams, and others) and one Go module (verana-blockchain), using stolen maintainer credentials to push trojanized versions that execute at install time via binding.gyp. The campaign harvests developer credentials, CI/CD secrets, and GitHub OIDC/PAT tokens, exfiltrating them via public GitHub repositories used as dead-drop infrastructure. Attribution to "Mini Shai-Hulud" / "TeamPCP" is unconfirmed — the actor has no MITRE ATT&CK profile in verified reference data. EMEA financial services with CI/CD pipelines consuming affected npm packages or GitHub Actions (notably codfish/semantic-release-action) face credential theft and lateral-movement risk into source-code and cloud environments.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Credential theft / maintainer account compromise. The npm developer account "czirker" (associated with LeoPlatform) was breached, likely via leaked credentials. The attacker used the maintainer's npm token to push trojanized package versions within a six-second window, evading automated revocation. (Source: The Hacker News — single-sourced for the "czirker" account name and six-second window detail.)
2. Malicious package publication. At least 24 npm packages and one Go module received trojanized versions. The full list of affected packages with versions:

• hexo-deployer-wrangler@1.0.4
• hexo-shoka-swiper@0.1.10
• leo-auth@4.0.6
• leo-aws@2.0.4
• leo-cache@1.0.2
• leo-cdk-lib@0.0.2
• leo-cli@3.0.3
• leo-config@1.1.1
• leo-connector-elasticsearch@2.0.6
• leo-connector-mongo@3.0.8
• leo-connector-mysql@3.0.3
• leo-connector-oracle@2.0.1
• leo-connector-redshift@3.0.6
• leo-cron@2.0.2
• leo-logger@1.0.8
• leo-sdk@6.0.19
• leo-streams@2.0.1
• prism-silq@1.0.1
• rstreams-metrics@2.0.2
• rstreams-shard-util@1.0.1
• serverless-convention@2.0.4
• serverless-leo@3.0.14
• solo-nav@0.1.1
• github.com/verana-labs/verana-blockchain@v0.10.1-dev.20 (Go)

3. Install-time execution via binding.gyp. The malicious npm packages do not use a lifecycle hook in package.json. Instead, they include a binding.gyp file that triggers arbitrary code execution during npm install. This launches a JavaScript loader.
4. Bun runtime staging. The JavaScript loader downloads and installs the Bun runtime if it is not already present on the host, then uses Bun to execute the stealer payload.
5. Credential and secret harvesting. The stealer payload harvests secrets, credentials, and tokens from the developer/build environment. It also drops a GitHub Actions workflow named "Run Copilot" designed to capture CI/CD environment secrets from the GitHub Actions runner memory.
6. Exfiltration via GitHub dead-drop. Stolen data is uploaded to a public GitHub repository with the description "Alright Lets See If This Works." As of writing, 559 repositories match this description, complicing takedown and detection. This is a key behavioural shift: the malware runs entirely within GitHub and does not require custom C2 infrastructure — GitHub is used for remote command execution, configuration, and data exfiltration.
7. C2 via GitHub commit search. The Miasma worm uses three independent GitHub commit search channels for C2, each with a different search string and purpose: - "DontRevokeOrItGoesBoom" — discovers attacker-controlled PATs to exfiltrate credentials and sensitive data. PATs are AES-256-CBC encrypted in the commit message. (Source: The Register — this string is from the earlier Miasma variant.) - "TheBeautifulSandsOfTime" — delivers JavaScript for immediate command execution. Checked once at startup; after validation, the payload is passed to eval() for runtime execution. - "firedalazer" — delivers Python script URLs for the persistent monitor. According to Endor Labs and OX Security, the malware polls GitHub every hour for commits matching "firedalazer" to retrieve and execute the Hades variant.

All three channels use GitHub's public commit search API, are unauthenticated by default, and each uses a different validation/decryption key — compromising one does not automatically compromise the other two.

8. Token relay marker evolution. The current artifact uses the string "RevokeAndItGoesKaboom" as the GitHub dead-drop resolver. This string has been linked to the compromise of the codfish/semantic-release-action GitHub Action. Earlier waves used "IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner."
9. codfish/semantic-release-action compromise. On June 24, 2026 at 15:39:06 UTC, an attacker force-pushed a malicious commit to codfish/semantic-release-action and redirected several version tags to point at the malicious commit. Any workflow that ran against one of these tags after that timestamp executed the attacker's payload inside the GitHub Actions runner. The payload: - Steals GitHub OIDC tokens - Harvests Personal Access Tokens matching known GitHub token patterns - Encrypts collected material with AES-128-GCM - Attempts to propagate a backdoor into other repositories accessible with the stolen credentials

(Source: StepSecurity, cited in The Hacker News.)

Malware capabilities and evasion

• Russian locale killswitch: The malware checks for a Russian locale and exits if detected.
• Endpoint security detection: The malware checks for the presence of endpoint security software before proceeding.
• IDE and AI coding assistant persistence: The malware establishes persistence in IDE and AI coding assistant configurations.
• No package.json lifecycle hook: By using binding.gyp instead of a package.json lifecycle script (e.g., postinstall), the malware evases naive package-analysis tools that inspect only package.json.
• AES encryption of exfiltrated data: Credentials are encrypted (AES-256-CBC for PATs in commit messages per The Register; AES-128-GCM for the semantic-release-action payload per StepSecurity) before exfiltration to GitHub.

Unconfirmed / single-sourced claims

• Attribution to "Mini Shai-Hulud" / "TeamPCP": The actor "Mini Shai-Hulud" has no MITRE ATT&CK profile in verified reference data. Attribution is unconfirmed. The Register reports that "TeamPCP" developed and open-sourced the mini Shai-Hulud worm, and that the Miasma repository was open-sourced on June 8 via four previously compromised users — but this lineage is not independently corroborated by MITRE or government attribution.
• "czirker" account compromise: The specific npm developer account name and the six-second publication window are reported only by The Hacker News / Socket. Single-sourced; verify before enforcement.
• 473 affected package artifacts: Socket is cited by The Register as tracking 473 affected package artifacts as of Tuesday (June 9). This figure is from a prior wave, not the current June 26 wave. Do not conflate.
• 559 repositories matching "Alright Lets See If This Works": Reported by The Hacker News. Single-sourced; the large number makes takedown impractical but also means the dead-drop description alone is low-fidelity for blocking.

Discrepancy note

The Register describes PAT encryption as AES-256-CBC (for the "DontRevokeOrItGoesBoom" channel), while StepSecurity describes the semantic-release-action payload encryption as AES-128-GCM. These are not contradictory — they describe different components of the attack toolkit using different encryption schemes. Both are noted here for completeness.

4. Mitigation & containment

P1 — Within 24 hours

1. Audit package manifests and lockfiles. Search all package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, and go.mod files across all repositories and CI/CD environments for any package from the affected list in §3. Use exact version matching. Example command: bash grep -rE "leo-auth@4.0.6|leo-aws@2.0.4|leo-cache@1.0.2|leo-cdk-lib@0.0.2|leo-cli@3.0.3|leo-config@1.1.1|leo-connector-elasticsearch@2.0.6|leo-connector-mongo@3.0.8|leo-connector-mysql@3.0.3|leo-connector-oracle@2.0.1|leo-connector-redshift@3.0.6|leo-cron@2.0.2|leo-logger@1.0.8|leo-sdk@6.0.19|leo-streams@2.0.1|rstreams-metrics@2.0.2|rstreams-shard-util@1.0.1|serverless-convention@2.0.4|serverless-leo@3.0.14|solo-nav@0.1.1|hexo-deployer-wrangler@1.0.4|hexo-shoka-swiper@0.1.10|prism-silq@1.0.1" . For Go: grep -r "verana-labs/verana-blockchain@v0.10.1-dev.20" .
2. Pin or remove affected packages. If any affected package/version is present, immediately pin to the last known-good version prior to the malicious release, or remove the dependency if feasible. Do not upgrade to the listed versions.
3. Revoke and rotate credentials. Rotate any npm tokens, GitHub PATs, OIDC tokens, and CI/CD secrets that may have been exposed in build environments where affected packages were installed. Prioritize any tokens with write access to package registries or repositories.
4. Block the codfish/semantic-release-action Action. If any GitHub Actions workflow references codfish/semantic-release-action, immediately disable or replace it. Any workflow that ran against a redirected tag after June 24, 2026 15:39:06 UTC should be treated as compromised. Audit Actions logs for runs after that timestamp.
5. Quarantine build runners. Any GitHub Actions runner or local developer machine that installed an affected package or ran the compromised Action after June 1, 2026 should be isolated, forensically imaged, and rebuilt from a known-good image.

P2 — Within 72 hours

6. Search for "Run Copilot" workflow. Audit all repositories for a GitHub Actions workflow file named or titled "Run Copilot." If found and unexplained, remove it and investigate. Check .github/workflows/ directories.
7. Search for dead-drop repositories. Query GitHub for repositories with the description "Alright Lets See If This Works." If any are accessible from your environment or associated with your organisation's GitHub accounts, treat them as exfiltration endpoints and report to GitHub for takedown.
8. Audit GitHub commit search activity. Review network logs from build runners for unauthenticated calls to GitHub's commit search API (api.github.com/search/commits) with query strings "DontRevokeOrItGoesBoom", "TheBeautifulSandsOfTime", "firedalazer", or "RevokeAndItGoesKaboom." Block these query strings at egress proxy/WAF where feasible.
9. Check for Bun runtime installation. Search build runners and developer machines for unexpected Bun runtime installations, particularly in non-standard paths. The malware downloads and installs Bun if not present.
10. Review IDE and AI coding assistant configurations. Check for unexplained modifications to IDE settings, Copilot configurations, or AI coding assistant config files that may indicate persistence mechanisms.

P3 — Within 7 days

11. Implement npm package provenance verification. Enable npm provenance and signature verification in CI/CD pipelines. Configure package managers to reject packages without verified provenance where the registry supports it.
12. Implement GitHub Actions allowlists. Restrict which GitHub Actions can run in organisational workflows using GitHub's Actions allowlist policy (actions_allowed_actions = selected). Pin Actions to commit SHAs rather than tags to prevent tag-redirect attacks.
13. Deploy package-scanning gates. Integrate a package-scanning tool (e.g., Socket, SafeDep PMG, Endor Labs, or equivalent) as a pre-merge and pre-install gate in CI/CD to detect binding.gyp-based install-time execution and known-malicious package signatures.
14. Harden OIDC token usage. Review GitHub Actions OIDC token permissions. Apply least-privilege permissions: blocks in all workflow files. Ensure id-token: write is only granted to workflows that require it, and that the aud claim is restricted to your cloud provider.
15. Conduct a credential-hygiene audit. Audit all developer machines and CI/CD environments for exposed credentials (.env files, environment variables, .npmrc files containing tokens, .git/config containing URLs with embedded credentials). Rotate any credentials found in plaintext.

5. Indicators of compromise

npm_package  hexo-deployer-wrangler@1.0.4
npm_package  hexo-shoka-swiper@0.1.10
npm_package  leo-auth@4.0.6
npm_package  leo-aws@2.0.4
npm_package  leo-cache@1.0.2
npm_package  leo-cdk-lib@0.0.2
npm_package  leo-cli@3.0.3
npm_package  leo-config@1.1.1
npm_package  leo-connector-elasticsearch@2.0.6
npm_package  leo-connector-mongo@3.0.8
npm_package  leo-connector-mysql@3.0.3
npm_package  leo-connector-oracle@2.0.1
npm_package  leo-connector-redshift@3.0.6
npm_package  leo-cron@2.0.2
npm_package  leo-logger@1.0.8
npm_package  leo-sdk@6.0.19
npm_package  leo-streams@2.0.1
npm_package  prism-silq@1.0.1
npm_package  rstreams-metrics@2.0.2
npm_package  rstreams-shard-util@1.0.1
npm_package  serverless-convention@2.0.4
npm_package  serverless-leo@3.0.14
npm_package  solo-nav@0.1.1
go_module  github.com/verana-labs/verana-blockchain@v0.10.1-dev.20
github_action  codfish/semantic-release-action
github_repo_description  Alright Lets See If This Works
github_workflow_name  Run Copilot
c2_search_string  DontRevokeOrItGoesBoom
c2_search_string  TheBeautifulSandsOfTime
c2_search_string  firedalazer
c2_search_string  RevokeAndItGoesKaboom
c2_search_string  IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner
npm_maintainer_account  czirker
encryption_scheme  AES-256-CBC
encryption_scheme  AES-128-GCM

6. Detection

YARA rule

rule Miasma_NPM_SupplyChain_Malware {
    meta {
        author = "Adverse Trace"
        date = "2026-06-26"
        reference = "https://thehackernews.com/2026/06/miasma-malware-targets-npm-packages-and.html"
        description = "Detects Miasma/Mini Shai-Hulud npm supply-chain malware artefacts based on C2 strings, workflow names, and dead-drop markers"
    }

    strings:
        $c2_string_1 = "DontRevokeOrItGoesBoom" ascii
        $c2_string_2 = "TheBeautifulSandsOfTime" ascii
        $c2_string_3 = "firedalazer" ascii
        $c2_string_4 = "RevokeAndItGoesKaboom" ascii
        $c2_string_5 = "IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner" ascii
        $dead_drop_desc = "Alright Lets See If This Works" ascii
        $workflow_name = "Run Copilot" ascii
        $eval_call = "eval()" ascii
        $binding_gyp = "binding.gyp" ascii

    condition:
        3 of them
}

Sigma rule

title: Detect Miasma Supply-Chain Malware C2 Activity via GitHub Commit Search API
id: 0a1b2c3d-4e5f-4a6b-8c9d-0e1f-2a3b
status: experimental
description: >
  Detects network requests to GitHub's commit search API containing C2 query strings
  associated with the Miasma/Mini Shai-Hulud npm supply-chain malware family.
references:

  - https://thehackernews.com/2026/06/miasma-malware-targets-npm-packages-and.html
  - https://www.theregister.com/cyber-crime/2026/06/09/miasma-supply-chain-attack-toolkit-goes-public-on-github/5253074
author: Adverse Trace
date: 2026/06/26
logsource:
    product: proxy
    service: http
detection:
    selection:
        c-uri|contains:

            - "api.github.com/search/commits"
        c-uri-query|contains|any:

            - "DontRevokeOrItGoesBoom"
            - "TheBeautifulSandsOfTime"
            - "firedalazer"
            - "RevokeAndItGoesKaboom"
            - "IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner"
    condition: selection
falsepositives:

    - Legitimate development activity referencing these strings (unlikely)
level: high

title: Detect Miasma "Run Copilot" Malicious GitHub Actions Workflow Creation
id: 1a2b3c4d-5e6f-4a7b-9c0d-1e2f-3a4b
status: experimental
description: >
  Detects creation of a GitHub Actions workflow file named "Run Copilot" associated
  with the Miasma npm supply-chain malware.
references:

  - https://thehackernews.com/2026/06/miasma-malware-targets-npm-packages-and.html
author: Adverse Trace
date: 2026/06/26
logsource:
    product: file
    service: filesystem
detection:
    selection:
        TargetFilename|contains:

            - ".github/workflows/"
        TargetFilename|contains|all:

            - "Run Copilot"
            - ".yml"
    condition: selection
falsepositives:

    - Legitimate workflow named "Run Copilot" (unlikely; verify with development team)
level: high

title: Detect codfish/semantic-release-action Compromised Tag Execution
id: 2a3b4c5d-6e7f-4a8b-0d1e-2f3a-4b5c
status: experimental
description: >
  Detects GitHub Actions workflow runs referencing codfish/semantic-release-action
  after the known compromise timestamp of 2026-06-24T15:39:06 UTC.
references:

  - https://thehackernews.com/2026/06/miasma-malware-targets-npm-packages-and.html
author: Adverse Trace
date: 2026/06/26
logsource:
    product: github
    service: audit
detection:
    selection_action:
        event.action|contains:

            - "codfish/semantic-release-action"
    filter_time:
        event.created: 2026-06-24T15:39:06 UTC
    condition: selection_action and filter_time
falsepositives:

    - Legitimate use of semantic-release-action with a known-good pinned SHA after remediation
level: critical

7. Sources

• The Hacker News — "Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack" — https://thehackernews.com/2026/06/miasma-malware-targets-npm-packages-and.html — 2026-06-26
• SecurityWeek — "Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks" — https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/ — 2026-06
• Cybersecurity Dive — "Dozens of Red Hat npm packages targeted in supply-chain attack" — https://www.cybersecuritydive.com/news/dozens-red-hat-npm-packages-supply-chain-attack/821723/ — 2026-06
• Sophos News — "'Mini Shai-Hulud' supply chain attack targets SAP npm packages" — https://www.sophos.com/en-gb/blog/-mini-shai-hulud-supply-chain-attack-targets-sap-npm-packages — 2026-06
• The Register — "Miasma worms its way onto GitHub as attack kit goes open source" — https://www.theregister.com/cyber-crime/2026/06/09/miasma-supply-chain-attack-toolkit-goes-public-on-github/5253074 — 2026-06-09
• Help Net Security — "Red Hat npm packages compromised in new Mini Shai-Hulud malware wave" — https://www.helpnetsecurity.com/2026/06/02/red-hat-npm-packages-compromised-mini-shai-hulud/ — 2026-06-02
• BleepingComputer — "Red Hat npm packages compromised to steal developer credentials" — https://www.bleepingcomputer.com/news/security/red-hat-npm-packages-compromised-to-steal-developer-credentials/ — 2026-06

8. Adverse Trace position

This is a high-severity supply-chain incident for any EMEA financial services firm whose CI/CD pipelines or developer workstations consume any of the 24 listed npm packages or the affected Go module, or whose GitHub Actions workflows reference codfish/semantic-release-action. The attack does not exploit a specific CVE — it is a credential-theft-driven supply-chain compromise — so there is no CVSS score or CISA-KEV entry to reference. Attribution to "Mini Shai-Hulud" / "TeamPCP" is unconfirmed (no MITRE ATT&CK profile exists for this actor). The "czirker" account compromise detail is single-sourced (The Hacker News / Socket); verify before enforcement. The attack's use of GitHub as the sole C2 and exfiltration channel means traditional network-based detection is insufficient — defenders must operate at the application-protocol layer to detect behavioural anomalies in GitHub API usage. Adverse Trace will continue monitoring for new affected package versions, additional GitHub Actions compromises, and any confirmed attribution. We will issue a follow-up advisory if the Hades variant (retrieved via the "firedalazer" C2 channel) is observed with new capabilities or if the 559 dead-drop repositories are taken down.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.