SlowMist issues npm supply chain attack alert, affecting 23 packages and stealing 408 GitHub repository credentials

The SlowMist security team has issued an alert stating that a variant of the Shai Hulu/Miasa/Hades npm malware is affecting the npm ecosystem and is related to the damaged npm developer account czirker. The attack utilized a pre configured binding.gyp file to execute malicious code during the npm install process. Currently, 23 affected packages have been confirmed, including 3140 weekly downloads of Leo logger, and 408 affected GitHub repositories containing stolen credentials have been detected.