{
  "title": "Leo Platform npm Miasma / Phantom Gyp Compromise",
  "summary": "StepSecurity disclosed a June 24, 2026 Leo Platform npm supply-chain compromise affecting 20 packages published in a three-second burst. Socket and Sonatype then tied three more malicious npm packages to the same Miasma / Mini Shai-Hulud Phantom Gyp tradecraft, extending the incident into a 23-package campaign update.",
  "date": "2026-06-25",
  "severity": "critical",
  "tags": [
    "npm",
    "leo-platform",
    "supply-chain",
    "credential-theft",
    "mini-shai-hulud",
    "miasma",
    "phantom-gyp"
  ],
  "sources_count": 5,
  "indicators": {
    "slug": "leo-platform-npm-miasma-compromise",
    "since": "2026-06-25T08:52:15Z",
    "until": "unknown",
    "ecosystem": "npm",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [
      "leo-logger",
      "leo-sdk",
      "leo-aws",
      "leo-config",
      "leo-streams",
      "serverless-leo",
      "leo-connector-mongo",
      "serverless-convention",
      "rstreams-metrics",
      "leo-connector-elasticsearch",
      "leo-auth",
      "leo-cache",
      "leo-cli",
      "hexo-deployer-wrangler",
      "hexo-shoka-swiper",
      "leo-cron",
      "leo-connector-redshift",
      "leo-connector-oracle",
      "prism-silq",
      "rstreams-shard-util",
      "leo-connector-mysql",
      "leo-cdk-lib",
      "solo-nav"
    ],
    "packages": [
      "leo-logger",
      "leo-sdk",
      "leo-aws",
      "leo-config",
      "leo-streams",
      "serverless-leo",
      "leo-connector-mongo",
      "serverless-convention",
      "rstreams-metrics",
      "leo-connector-elasticsearch",
      "leo-auth",
      "leo-cache",
      "leo-cli",
      "hexo-deployer-wrangler",
      "hexo-shoka-swiper",
      "leo-cron",
      "leo-connector-redshift",
      "leo-connector-oracle",
      "prism-silq",
      "rstreams-shard-util",
      "leo-connector-mysql",
      "leo-cdk-lib",
      "solo-nav"
    ],
    "versions": [
      "leo-logger@1.0.8",
      "leo-sdk@6.0.19",
      "leo-aws@2.0.4",
      "leo-config@1.1.1",
      "leo-streams@2.0.1",
      "serverless-leo@3.0.14",
      "leo-connector-mongo@3.0.8",
      "serverless-convention@2.0.4",
      "rstreams-metrics@2.0.2",
      "leo-connector-elasticsearch@2.0.6",
      "leo-auth@4.0.6",
      "leo-cache@1.0.2",
      "leo-cli@3.0.3",
      "hexo-deployer-wrangler@1.0.4",
      "hexo-shoka-swiper@0.1.10",
      "leo-cron@2.0.2",
      "leo-connector-redshift@3.0.6",
      "leo-connector-oracle@2.0.1",
      "prism-silq@1.0.1",
      "rstreams-shard-util@1.0.1",
      "leo-connector-mysql@3.0.3",
      "leo-cdk-lib@0.0.2",
      "solo-nav@1.0.1"
    ],
    "affectedVersions": [
      "leo-logger@1.0.8",
      "leo-sdk@6.0.19",
      "leo-aws@2.0.4",
      "leo-config@1.1.1",
      "leo-streams@2.0.1",
      "serverless-leo@3.0.14",
      "leo-connector-mongo@3.0.8",
      "serverless-convention@2.0.4",
      "rstreams-metrics@2.0.2",
      "leo-connector-elasticsearch@2.0.6",
      "leo-auth@4.0.6",
      "leo-cache@1.0.2",
      "leo-cli@3.0.3",
      "hexo-deployer-wrangler@1.0.4",
      "hexo-shoka-swiper@0.1.10",
      "leo-cron@2.0.2",
      "leo-connector-redshift@3.0.6",
      "leo-connector-oracle@2.0.1",
      "prism-silq@1.0.1",
      "rstreams-shard-util@1.0.1",
      "leo-connector-mysql@3.0.3",
      "leo-cdk-lib@0.0.2",
      "solo-nav@1.0.1"
    ],
    "fixedVersions": [],
    "files": [
      "binding.gyp",
      "index.js",
      "stub.c"
    ],
    "paths": [],
    "services": [],
    "domains": [
      "api.github.com",
      "github.com"
    ],
    "urls": [
      "https://api.github.com/graphql",
      "https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/"
    ],
    "ips": [],
    "hashes": [
      "d45ad3cffbcc7c4b354ebe9d71d002fa585379ec",
      "1dcc0a39e1cd7293a9058cfc41e1afe8b397c943",
      "ef8bf6dd92cbc29ef8d23f3f0fa786ed20a856b1",
      "9be49287057cd6a54ef4a70a8d541a7259efbd2d",
      "c05068f18e7f94304b92a307a030e0038ab61004",
      "cb78d0dca573f99a22b41ca01e99853a6162d5d5",
      "c721c184dbb5c2dc23bacfd28571daef1decfac1"
    ],
    "processPatterns": [
      "Runner.Worker",
      "/proc/{pid}/mem",
      "bypass_2fa",
      "ALL=(ALL) NOPASSWD:ALL",
      "/tmp/p"
    ],
    "networkPatterns": [
      "GitHub GraphQL API exfiltration with victim token",
      "Bun v1.3.13 download during install"
    ],
    "telemetrySelectors": []
  }
}