Mini Shai-Hulud Worm Jumps to Go, Hits LeoPlatform and RStreams npm Packages

The npm supply chain campaign variously tracked as Mini Shai-Hulud, Miasma and Hades has expanded again, with researchers documenting fresh malicious releases and a jump into the Go ecosystem.

The family first surfaced as a derivative of the original Shai-Hulud worm that ripped through npm earlier this year, harvesting developer credentials and republishing trojanized versions of legitimate packages. It is self-propagating. Once it lands on a maintainer's machine, it uses their tokens to push poisoned releases of whatever else they publish.

The latest wave hits packages published under the LeoPlatform and RStreams namespaces. Both are used in data-streaming and serverless analytics pipelines, the kind of dependency that gets pulled deep into build trees without anyone reading the changelog.

The operators are also abusing GitHub Actions workflows. By tampering with CI configuration in compromised repositories, the malware gets a second persistence path — one that fires every time a maintainer pushes code, independent of whether the local npm token has been rotated. That is the part defenders should pay attention to. Removing a bad package version does not clean the pipeline that produced it.

The move into Go is the other notable beat. A related Go-based component has been observed alongside the npm activity, suggesting the crew is either porting capability or staging for a broader registry push. Go's module system does not have the same publish-and-overwrite dynamics as npm, but credential theft from a developer workstation cuts across ecosystems.

No victim org has been named. There is no ransom component here; the payload is built around token theft, secret exfiltration and onward propagation, in line with the earlier Shai-Hulud activity that scraped AWS keys, GitHub PATs and npm tokens from infected environments.

For teams running npm or Go in production, the practical steps are unchanged from the September wave. Audit recent installs of any LeoPlatform or RStreams packages. Pin versions. Rotate npm publish tokens and any GitHub PATs that touched a CI runner in the affected window. Review GitHub Actions workflow files in your own repos for unexpected diffs, especially additions that run shell scripts pulled from remote URLs or echo environment variables to network endpoints.

GitHub's own guidance on securing the software supply chain covers the workflow-tampering angle in detail and is worth re-reading: GitHub Actions security hardening.

The campaign is still active at time of writing. Expect more package names to surface as registries and researchers work through the dependency graph.