- The Mini Shai-Hulud malware campaign has evolved, compromising new npm packages and now spreading to the Go ecosystem.
- Over 20 npm packages and the Verana Blockchain Go module were infected to steal developer credentials and tokens.
- The attackers used breached maintainer accounts to push malicious updates and propagate via GitHub Actions and dead-drop repositories.
- Malicious code executes during installation, harvesting secrets and attempting to backdoor additional repositories with stolen access.
A sophisticated supply chain attack linked to the Mini Shai-Hulud, Miasma, and Hades malware families has compromised a new wave of npm packages and spread to the Go ecosystem. Cybersecurity researchers at Socket reported that LeoPlatform and RStreams npm packages, as well as the Verana Blockchain Go module, were targeted. The campaign’s ultimate goal remains harvesting developer credentials to weaponize trusted workflows and spread further.
Consequently, a compromised npm developer account likely allowed the attackers to push trojanized versions of 23 listed packages within seconds. The malware uses a binding.gyp file to execute code during installation, launching a JavaScript loader that downloads the Bun runtime. This payload then steals secrets, credentials, and tokens from the infected environment.
Meanwhile, the attackers also abused GitHub Actions, creating a workflow named “Run Copilot” to capture CI/CD secrets. Stolen data is uploaded to public GitHub repositories with the description “Alright Lets See If This Works”, of which there are now 559. Furthermore, StepSecurity said the campaign compromised the “codfish/semantic-release-action” GitHub Action, using a similar token relay marker.
The attack pattern indicates a persistent operational cluster, as noted by Endor Labs and OX Security. JFrog highlighted that the payload isn’t radically new but continues to evolve its indicators. This expansion into the Go ecosystem shows the campaign is targeting developer workflows across multiple platforms.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
