Which versions of rstreams-shard-util are malicious?

The following npm versions of rstreams-shard-util are flagged malicious: 1.0.1. Treat any of these as compromised.

How do I remediate rstreams-shard-util if I installed it?

rstreams-shard-util is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed rstreams-shard-util — how do I know if it already compromised me?

If rstreams-shard-util was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is rstreams-shard-util part of a known attack campaign?

Yes — rstreams-shard-util is associated with the IN-MAL-2026-007481, GHSA-29q5-mm45-3xm3 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find rstreams-shard-util across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for rstreams-shard-util (version 1.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging rstreams-shard-util across your stack and pipelines.

Malicious package

rstreams-shard-utilnpm

Malicious code in rstreams-shard-util (npm) Remove it immediately and rotate any exposed credentials.

MAL-2026-6433

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall rstreams-shard-util

What this malware does

The rstreams-shard-util npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform organization.

The malicious payload is triggered automatically during npm install via a binding.gyp file using node-gyp command expansion (<!(node index.js > /dev/null 2>&1 && echo stub.c)), which bypasses lifecycle script scanners. The replaced index.js (~5.2 MB, obfuscated with ROT-N + AES-128-GCM encryption) deploys a multi-stage worm with the following capabilities:

Credential theft: Targets npm, GitHub, PyPI, RubyGems, Kubernetes, HashiCorp Vault, AWS (IAM keys, Secrets Manager, IMDS), 1Password, JFrog Artifactory, and SSH keys.
AI tool targeting: Exfiltrates configuration files for Claude, Cursor, Gemini, and VS Code.
Worm propagation: Enumerates npm packages and auto-publishes version bumps to spread to other maintainers in the ecosystem.
GitHub persistence: Creates orphan snapshot-<hex> branches with fake "Dependabot Updates" workflows to maintain access after initial compromise.

Any system that installed this version should be considered fully compromised. Rotate all secrets immediately from a separate, clean machine. See the linked SafeDep report for full payload analysis, indicators of compromise, and remediation guidance.

The package ships a binding.gyp whose sources field at line 6 uses GYP command-expansion syntax (<!(...)). When npm installs a package containing binding.gyp, it implicitly runs node-gyp rebuild, and the GYP configure step evaluates <!(...) expressions as shell commands — executing arbitrary code on the installer's machine without any declared install/postinstall lifecycle script. This mechanism is functionally equivalent to a postinstall hook but is far less visible to reviewers, since package.json shows no lifecycle scripts. The package contains no legitimate native source files that would justify a binding.gyp, indicating the file's only purpose is to trigger the embedded shell command on install.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

1.0.1

Indicators of compromise (SHA-256)

5b8add0d2dc18ec5b953eb3d02c8926b2f186cc25b8e6cfa76fb4a6123d6aaf9

994f994b1f1302ba49199d251480407d1c83c0974f96edbe5e0294e8ec6607c1

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for rstreams-shard-util (version 1.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging rstreams-shard-util across your stack and pipelines.
If you installed it — respond
rstreams-shard-util is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If rstreams-shard-util was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks rstreams-shard-util before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. rstreams-shard-util on npm has been identified as a malicious package (version 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007481GHSA-29q5-mm45-3xm3

References

Credits

Amazon Inspector · finder
SafeDep · finder

Detect & block this

O3 blocks rstreams-shard-util-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring