Mini Shai-Hulud Worm Jumps to Go, Hits LeoPlatform and RStreams npm Packages

Key points

• Malicious npm releases targeting LeoPlatform and RStreams packages have been confirmed as part of the Miasma/Hades campaign.
• The malware abuses GitHub Actions workflows to persist in compromised repositories after bad package versions are removed.
• A related Go-based component has been observed, suggesting the crew is expanding beyond npm.
• The payload steals tokens and secrets, including AWS keys, GitHub personal access tokens and npm publish tokens.
• Rotating credentials is not enough if the CI pipeline that fired them is still compromised.

What is this campaign and who is at risk?

Researchers have flagged fresh activity from the malware family tracked as Mini Shai-Hulud, Miasma and Hades: new malicious npm releases and a move into the Go ecosystem. The family is self-propagating. Once it lands on a maintainer's machine, it uses their tokens to push poisoned releases of whatever else they publish. We've followed this campaign since our first report on 2 June 2026, and it hasn't stopped moving.

The latest wave targets packages published under the LeoPlatform and RStreams namespaces. Both serve data-streaming and serverless analytics pipelines, the kind of dependency that gets pulled deep into build trees without anyone reading the changelog. That reach is what makes this family dangerous: the infection isn't in one package, it's in the developer who maintains dozens.

Should you be worried about the GitHub Actions angle?

Yes, and here's why it changes the calculus. By tampering with CI configuration in compromised repositories, the malware gets a second persistence path that fires every time a maintainer pushes code, independent of whether their local npm token has been rotated. Removing a bad package version doesn't clean the pipeline that produced it. That's the detail defenders are most likely to miss. Our coverage of the Megalodon campaign on 28 May 2026 showed how fast a compromised Actions workflow can move through a dependency graph; the same logic applies here.

What does the Go component mean?

A related Go-based component has been observed alongside the npm activity. Go's module system doesn't support the same publish-and-overwrite dynamics as npm, but credential theft from a developer workstation cuts across registries. Whether the crew is porting capability or staging for a broader push isn't confirmed yet. Either way, teams running Go in production should treat this as relevant.

What should defenders do right now?

Audit recent installs of any LeoPlatform or RStreams packages. Pin versions. Rotate npm publish tokens and any GitHub personal access tokens that touched a CI runner in the affected window. Then review GitHub Actions workflow files in your own repositories for unexpected changes, especially additions that run shell scripts from remote URLs or write environment variables to network endpoints. GitHub's own hardening guidance covers the workflow-tampering angle: GitHub Actions security hardening.

No victim organisation has been named. There's no ransom demand: the payload is built around token theft and secret exfiltration, consistent with the earlier Shai-Hulud activity that scraped AWS keys, GitHub tokens and npm credentials from infected environments.

The campaign is still active. Expect more package names to surface as registries and researchers work through the dependency graph. The practical risk isn't the packages already flagged; it's the ones the worm has already seeded that nobody has looked at yet.