Microsoft Threat Intelligence @threatintel.microsoft.com · Jun 25 Microsoft has observed a supply chain attack targeting the Leo Platform/RStreams npm ecosystem. On June 24, 2026, at 23:04:55 UTC, a compromised maintainer account ("czirker") to publish malicious versions of 20+ npm packages in a coordinated, fully automated operation completed in under 3 seconds.
4 likes 1 replies
?
Replies
Each malicious package ships a tiny binding.gyp and a large index.js with no postinstall script. The attacker hides the install hook inside node-gyp's command expansion: binding.gyp sources array contains <!(node index.js > /dev/null 2>&1 && echo stub.c), so npm install runs index.js at build time.