Skip to content

Commit d753592

Browse files
adel-pplxadel-pplx
authored
feat(threat_intel): add Mini Shai-Hulud / Miasma LeoPlatform exposure catalog (#60)
Co-authored-by: adel-pplx <254727879+adel-pplx@users.noreply.github.com>
1 parent cc57710 commit d753592

2 files changed

Lines changed: 304 additions & 0 deletions

File tree

‎threat_intel/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ the entries against current advisories before production use.
1313
| File | Campaign | Source |
1414
|---|---|---|
1515
| [`mastra-2026-06-17.json`](mastra-2026-06-17.json) | Mastra npm supply-chain compromise (141 packages / 141 versions across `@mastra/*` plus `create-mastra` and the `easy-day-js@1.11.22` typosquat dependency that delivered a cross-platform infostealer via postinstall) | [Socket, 2026-06-17](https://socket.dev/blog/mastra-npm-packages-compromised) |
16+
| [`mini-shai-hulud-leoplatform-2026-06-24.json`](mini-shai-hulud-leoplatform-2026-06-24.json) | Mini Shai-Hulud / Miasma (Hades variant) LeoPlatform/RStreams wave (compromised `czirker` npm account; 26 npm packages + 1 Go module / 27 versions; "Phantom Gyp" `binding.gyp` install hook, Bun-staged infostealer, "Alright Lets See If This Works" dead-drop marker) | [Socket, 2026-06-24](https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem); [OX Security, 2026-06-24](https://www.ox.security/blog/alright-lets-see-if-this-works-shai-hulud-miasma-hades-variant-spreads-on-npm/) |
1617
| [`mini-shai-hulud.json`](mini-shai-hulud.json) | Mini/Shai-Hulud May 2026 npm and PyPI compromise (OX Security affected-package table) | Cross-checked against Fleet, Socket, Snyk, Mistral, TanStack, The Hacker News |
1718
| [`mini-shai-hulud-redhat-cloud-services.json`](mini-shai-hulud-redhat-cloud-services.json) | Mini Shai-Hulud compromise of Red Hat Cloud Services (`@redhat-cloud-services`) npm packages (32 packages / 95 versions; "Miasma: The Spreading Blight" worm marker) | [Socket, 2026-06-01](https://socket.dev/blog/mini-shai-hulud-campaign-hits-red-hat-cloud-services-npm-packages) |
1819
| [`laravel-lang-2026-05-23.json`](laravel-lang-2026-05-23.json) | Laravel Lang Composer/Packagist supply-chain compromise across `laravel-lang/lang`, `laravel-lang/http-statuses`, `laravel-lang/attributes`, and `laravel-lang/actions` | [Socket, 2026-05-23](https://socket.dev/blog/laravel-lang-compromise) |

‎threat_intel/mini-shai-hulud-leoplatform-2026-06-24.json‎

Lines changed: 303 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,303 @@
1+
{
2+
"schema_version": "0.1.0",
3+
"_comment": "Mini Shai-Hulud / Miasma (Hades-variant) supply-chain compromise of the LeoPlatform / RStreams npm ecosystem, wave reported on 2026-06-24 by Socket (https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem) and OX Security (https://www.ox.security/blog/alright-lets-see-if-this-works-shai-hulud-miasma-hades-variant-spreads-on-npm/). A compromised npm maintainer account (czirker) mass-published malicious patch/pre-release versions of LeoPlatform and RStreams packages that execute at install time via a node-gyp binding.gyp command-substitution hook (the \"Phantom Gyp\" technique), staging an obfuscated multi-stage infostealer under the Bun runtime that exfiltrates secrets to attacker-controlled GitHub repos marked \"Alright Lets See If This Works\". This catalog covers the full reported union: 26 npm packages (20 core czirker packages confirmed by both Socket and OX; 3 pre-release leo-connector-* packages reported by OX only; and 3 packages \u2014 hexo-deployer-wrangler, hexo-shoka-swiper, prism-silq \u2014 published by the related npm account llxlr per Socket) plus 1 Go module (github.com/verana-labs/verana-blockchain), each at the single reported compromised version (27 package-version pairs total). Intended for exact (ecosystem, package, version) presence checks, not network/file/process IOC checks.",
4+
"entries": [
5+
{
6+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-hexo-deployer-wrangler",
7+
"name": "hexo-deployer-wrangler (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
8+
"ecosystem": "npm",
9+
"package": "hexo-deployer-wrangler",
10+
"versions": [
11+
"1.0.4"
12+
],
13+
"severity": "critical",
14+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
15+
},
16+
{
17+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-hexo-shoka-swiper",
18+
"name": "hexo-shoka-swiper (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
19+
"ecosystem": "npm",
20+
"package": "hexo-shoka-swiper",
21+
"versions": [
22+
"0.1.10"
23+
],
24+
"severity": "critical",
25+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
26+
},
27+
{
28+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-auth",
29+
"name": "leo-auth (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
30+
"ecosystem": "npm",
31+
"package": "leo-auth",
32+
"versions": [
33+
"4.0.6"
34+
],
35+
"severity": "critical",
36+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
37+
},
38+
{
39+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-aws",
40+
"name": "leo-aws (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
41+
"ecosystem": "npm",
42+
"package": "leo-aws",
43+
"versions": [
44+
"2.0.4"
45+
],
46+
"severity": "critical",
47+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
48+
},
49+
{
50+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-cache",
51+
"name": "leo-cache (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
52+
"ecosystem": "npm",
53+
"package": "leo-cache",
54+
"versions": [
55+
"1.0.2"
56+
],
57+
"severity": "critical",
58+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
59+
},
60+
{
61+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-cdk-lib",
62+
"name": "leo-cdk-lib (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
63+
"ecosystem": "npm",
64+
"package": "leo-cdk-lib",
65+
"versions": [
66+
"0.0.2"
67+
],
68+
"severity": "critical",
69+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
70+
},
71+
{
72+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-cli",
73+
"name": "leo-cli (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
74+
"ecosystem": "npm",
75+
"package": "leo-cli",
76+
"versions": [
77+
"3.0.3"
78+
],
79+
"severity": "critical",
80+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
81+
},
82+
{
83+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-config",
84+
"name": "leo-config (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
85+
"ecosystem": "npm",
86+
"package": "leo-config",
87+
"versions": [
88+
"1.1.1"
89+
],
90+
"severity": "critical",
91+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
92+
},
93+
{
94+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-connector-common",
95+
"name": "leo-connector-common (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
96+
"ecosystem": "npm",
97+
"package": "leo-connector-common",
98+
"versions": [
99+
"4.0.11-rc"
100+
],
101+
"severity": "critical",
102+
"source": "https://www.ox.security/blog/alright-lets-see-if-this-works-shai-hulud-miasma-hades-variant-spreads-on-npm/"
103+
},
104+
{
105+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-connector-elasticsearch",
106+
"name": "leo-connector-elasticsearch (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
107+
"ecosystem": "npm",
108+
"package": "leo-connector-elasticsearch",
109+
"versions": [
110+
"2.0.6"
111+
],
112+
"severity": "critical",
113+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
114+
},
115+
{
116+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-connector-entity-table",
117+
"name": "leo-connector-entity-table (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
118+
"ecosystem": "npm",
119+
"package": "leo-connector-entity-table",
120+
"versions": [
121+
"3.0.22-rc"
122+
],
123+
"severity": "critical",
124+
"source": "https://www.ox.security/blog/alright-lets-see-if-this-works-shai-hulud-miasma-hades-variant-spreads-on-npm/"
125+
},
126+
{
127+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-connector-mongo",
128+
"name": "leo-connector-mongo (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
129+
"ecosystem": "npm",
130+
"package": "leo-connector-mongo",
131+
"versions": [
132+
"3.0.8"
133+
],
134+
"severity": "critical",
135+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
136+
},
137+
{
138+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-connector-mysql",
139+
"name": "leo-connector-mysql (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
140+
"ecosystem": "npm",
141+
"package": "leo-connector-mysql",
142+
"versions": [
143+
"3.0.3"
144+
],
145+
"severity": "critical",
146+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
147+
},
148+
{
149+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-connector-oracle",
150+
"name": "leo-connector-oracle (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
151+
"ecosystem": "npm",
152+
"package": "leo-connector-oracle",
153+
"versions": [
154+
"2.0.1"
155+
],
156+
"severity": "critical",
157+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
158+
},
159+
{
160+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-connector-postgres",
161+
"name": "leo-connector-postgres (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
162+
"ecosystem": "npm",
163+
"package": "leo-connector-postgres",
164+
"versions": [
165+
"4.0.19-beta"
166+
],
167+
"severity": "critical",
168+
"source": "https://www.ox.security/blog/alright-lets-see-if-this-works-shai-hulud-miasma-hades-variant-spreads-on-npm/"
169+
},
170+
{
171+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-connector-redshift",
172+
"name": "leo-connector-redshift (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
173+
"ecosystem": "npm",
174+
"package": "leo-connector-redshift",
175+
"versions": [
176+
"3.0.6"
177+
],
178+
"severity": "critical",
179+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
180+
},
181+
{
182+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-cron",
183+
"name": "leo-cron (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
184+
"ecosystem": "npm",
185+
"package": "leo-cron",
186+
"versions": [
187+
"2.0.2"
188+
],
189+
"severity": "critical",
190+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
191+
},
192+
{
193+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-logger",
194+
"name": "leo-logger (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
195+
"ecosystem": "npm",
196+
"package": "leo-logger",
197+
"versions": [
198+
"1.0.8"
199+
],
200+
"severity": "critical",
201+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
202+
},
203+
{
204+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-sdk",
205+
"name": "leo-sdk (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
206+
"ecosystem": "npm",
207+
"package": "leo-sdk",
208+
"versions": [
209+
"6.0.19"
210+
],
211+
"severity": "critical",
212+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
213+
},
214+
{
215+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-leo-streams",
216+
"name": "leo-streams (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
217+
"ecosystem": "npm",
218+
"package": "leo-streams",
219+
"versions": [
220+
"2.0.1"
221+
],
222+
"severity": "critical",
223+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
224+
},
225+
{
226+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-prism-silq",
227+
"name": "prism-silq (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
228+
"ecosystem": "npm",
229+
"package": "prism-silq",
230+
"versions": [
231+
"1.0.1"
232+
],
233+
"severity": "critical",
234+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
235+
},
236+
{
237+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-rstreams-metrics",
238+
"name": "rstreams-metrics (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
239+
"ecosystem": "npm",
240+
"package": "rstreams-metrics",
241+
"versions": [
242+
"2.0.2"
243+
],
244+
"severity": "critical",
245+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
246+
},
247+
{
248+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-rstreams-shard-util",
249+
"name": "rstreams-shard-util (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
250+
"ecosystem": "npm",
251+
"package": "rstreams-shard-util",
252+
"versions": [
253+
"1.0.1"
254+
],
255+
"severity": "critical",
256+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
257+
},
258+
{
259+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-serverless-convention",
260+
"name": "serverless-convention (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
261+
"ecosystem": "npm",
262+
"package": "serverless-convention",
263+
"versions": [
264+
"2.0.4"
265+
],
266+
"severity": "critical",
267+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
268+
},
269+
{
270+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-serverless-leo",
271+
"name": "serverless-leo (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
272+
"ecosystem": "npm",
273+
"package": "serverless-leo",
274+
"versions": [
275+
"3.0.14"
276+
],
277+
"severity": "critical",
278+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
279+
},
280+
{
281+
"id": "mini-shai-hulud-leoplatform-2026-06-24-npm-solo-nav",
282+
"name": "solo-nav (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
283+
"ecosystem": "npm",
284+
"package": "solo-nav",
285+
"versions": [
286+
"1.0.1"
287+
],
288+
"severity": "critical",
289+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
290+
},
291+
{
292+
"id": "mini-shai-hulud-leoplatform-2026-06-24-go-github-com-verana-labs-verana-blockchain",
293+
"name": "github.com/verana-labs/verana-blockchain (Mini Shai-Hulud / Miasma LeoPlatform compromise)",
294+
"ecosystem": "go",
295+
"package": "github.com/verana-labs/verana-blockchain",
296+
"versions": [
297+
"v0.10.1-dev.20"
298+
],
299+
"severity": "critical",
300+
"source": "https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem"
301+
}
302+
]
303+
}

0 commit comments

Comments
 (0)