Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem

Socket Threat Research documents an active, sophisticated supply-chain campaign (Mini Shai-Hulud / Miasma / Hades) that poisoned numerous npm packages (LeoPlatform/RStreams ecosystem) and a Verana Blockchain Go module to run obfuscated Bun-staged JavaScript payloads via binding.gyp and IDE/AI-agent hooks; the malware steals a broad set of developer and CI/CD secrets, abuses GitHub Actions (including dead-drop behavior marked by strings like "RevokeAndItGoesKaboom"), and includes detailed IOCs and defensive remediation steps.