Miasma Returns: Leo Platform Compromise in npm

Sonatype reports a resurgence of the "Shai-Hulud Miasma" npm supply-chain campaign in which a compromised maintainer account published malicious package versions (≈23) that abuse binding.gyp/node-gyp to execute during installation, enabling credential theft, persistence, and propagation through trusted publishing workflows; organizations should treat developer workstations, CI/CD runners, and build containers as potentially compromised, remove malicious versions, investigate install-time execution, and rotate credentials only after removing persistence.