The SlowMist security team has issued an alert regarding a new npm supply chain attack involving the Shai-Hulud/Miasma/Hades malware variant. This attack, linked to the compromised npm developer account czirker, affects 23 npm packages, including leo-logger, which has a weekly download count of 3,140. The malware uses a pre-configured binding.gyp file to execute malicious code during the npm install process. The attack has resulted in the theft of credentials from 408 GitHub repositories. Attackers can exploit this breach to steal GitHub and npm tokens, cloud service credentials, and exfiltrate local environment data. SlowMist advises security teams to review lockfiles and package histories, downgrade or remove affected packages, rotate all related keys and credentials, and enforce two-factor authentication to mitigate risks.