malware
npm
leo-sdk
discovered 2026-06-24LeoPlatform package infected by Miasma worm. High traffic target (1,830 weekly downloads). Also referenced in GitHub Actions workflow OIDC_PACKAGES env var.
Threat types
worm credential_stealer data_exfiltration
Malicious versions
- 6.0.19
Campaigns
Indicators
Techniques
- ttp T1195.001 Compromise Software Dependencies and Development Toolsuses
- ttp Phantom Gyp binding.gyp Abuseuses
- ttp T1027 Obfuscated Files or Informationuses
- ttp T1105 Ingress Tool Transferuses
- ttp T1528 Steal Application Access Tokenuses
- ttp T1567.001 Exfiltration to Code Repositoryuses
- ttp Self-Propagation via Trusted Publishing Wormuses
- ttp T1036 Masqueradinguses
