Woofun AI reports that a new variant of the Shai-Hulud / Miasma / Hades malware has emerged in the npm ecosystem, linked to the compromised developer account czirker. The attack exploits pre-configured binding.gyp files to execute malicious code during the npm install process.

Twenty-three software packages are affected, with the leo-logger package recording up to 3,140 weekly downloads. Security teams have identified 408 infected GitHub repositories containing stolen credentials. Risks include theft of GitHub and npm tokens, AWS/GCP/Azure cloud credentials, local environment data leakage, and misuse of GitHub Actions workflows. Mitigation requires checking package history, removing affected packages, rotating all service keys, and enabling two-factor authentication.