Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised

On June 24, 2026, a coordinated supply chain attack compromised 20 npm packages within the Leo Platform ecosystem, all published within a 3-second window. The malicious packages contain a CI/CD attack toolkit that steals secrets from GitHub Actions runners, cloud environments, and credential stores, then exfiltrates them using the victim's own GitHub token. The attack uses the same 'Phantom Gyp' technique and obfuscation chain as the earlier Miasma campaign, indicating the same threat actor. These packages collectively receive around 13,600 weekly downloads, posing significant risk to CI/CD pipelines.

AI-extracted · verify before operational use