On 24 June 2026 attackers compromised the npm maintainer account czirker and used it to publish malicious versions of packages in the Leo Platform and RStreams ecosystems. Sonatype, writing on 25 June, links 23 malicious package versions to the wave. Public reports differ: some list 23 packages, others 20 confirmed ones.
Like the earlier Miasma waves, the malware runs through a binding.gyp file, so it executes during install without any lifecycle script.
What's affected
Sonatype did not publish the full list of Leo and RStreams versions, so use its advisory (Sonatype-2026-004261) for the complete set. It did name three extra malicious packages from a likely compromised account, llxlr:
hexo-deployer-wrangler@1.0.4hexo-shoka-swiper@0.1.10prism-silq@1.0.1
It also flagged three packages in early reports that do not appear to contain malicious code but deserve review: leo-connector-common@4.0.11-rc, leo-connector-postgres@4.0.19-beta and leo-connector-entity-table@3.0.22-rc.
The payload targets GitHub tokens and Actions secrets, npm publishing tokens, cloud credentials, SSH keys, shell history, and IDE and AI assistant configuration.
What to do now
- Search lockfiles, caches, internal mirrors, container images and SBOMs for
leo-*,rstreamsand the three names above.
grep -rn -E '"(leo-|@leo|rstreams)' package-lock.json
grep -l '<!(' node_modules/*/binding.gyp 2>/dev/null
- Review install logs for
node-gypactivity, obfuscated JavaScript execution, unexpected temp files and outbound connections. - Preserve logs and isolate affected systems. Regenerate lockfiles from known-good versions.
- Rotate credentials only after the host is investigated and clean. Sonatype warns that if persistence remains, new credentials can be exposed again.
How this could have been avoided
- Protect the maintainer account. Access came through a single hijacked account, so enforced 2FA and tokens scoped to publish only the packages they need limit what one theft can do.
- Alert on version bursts. Many releases across a family in minutes is a pattern registries and consumers can both watch.
- Flag unexpected
binding.gypin packages that never shipped native code. - Delay adoption. A cooldown on brand-new versions covers the first hours when these are most often caught.
Quick check
Why do these packages avoid preinstall and postinstall scripts?
They use binding.gyp, which npm builds through node-gyp at install time, so lifecycle script reviews miss them.
