Miasma poisoned LeoPlatform npm and jumped to a Go module

A late-June 2026 wave of the Miasma worm poisoned 23 npm packages belonging to the LeoPlatform and RStreams data-streaming projects, along with three packages published by the account llxlr. Socket, which analyzed the wave, also found compromise indicators in a Go module for the Verana Blockchain project. That made it the first time the campaign reached outside npm.

LeoPlatform and RStreams publish serverless data-streaming libraries for AWS. The malicious releases went out in a tight window, inserted as new patch versions across every supported major release series at once, so a project pinned to any maintained line would pick one up. The delivery reused the technique from the June 3 wave: a weaponized binding.gyp that runs during npm install when node-gyp evaluates it, rather than a lifecycle script that an install-time scanner would flag.

From there the chain ran through a ROT Caesar layer, AES-GCM decryption, and a downloaded Bun runtime used to execute the JavaScript payload outside Node's own security hooks. It collected npm tokens, GitHub secrets, SSH keys, and cloud credentials, and searched for GitHub Actions workflows with publishing permissions to extract more. The marker string RevokeAndItGoesKaboom tied the wave to earlier GitHub Actions compromises in the same family.

The persistence is what distinguishes this wave. Rather than relying on the package staying installed, the malware wrote hooks into developer tooling configuration for Claude, VS Code, Cursor, and Copilot, staging payloads in a .claude folder with a VS Code folder-open task that invokes node .claude/setup.mjs. A developer who merely opened a poisoned repository later would execute it, which extends the blast radius well past whoever ran the original install. Socket advised rotating exposed credentials from a clean machine and auditing repositories for injected workflows, unexpected branches, and .claude/ or .github/ configuration files. Researchers track the family under the overlapping names Mini Shai-Hulud, Miasma, and Hades.