[Under Evaluation]: Malicious releases of 23 Leo Platform npm packages execute an install-time dropper (Phantom binding.gyp hook) and multi-stage payload using GitHub for C2/delivery, stealing GitHub Actions secrets and cloud/registry/password-manager creds and exfiltrating via the victim’s GitHub token. Affected: [email protected], [email protected], [email protected], [email protected], [email protected], others listed. Remove/rollback, rotate secrets, audit workflows.