Fact-check findings
What an automated fact-checker found when it re-read Leo Platform npm Supply Chain Attack (June 2026) against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #8[disputed][awaiting moderator]in section: Broader Campaign Context
“and upgrade to clean package versions published after June 24, 2026 at 23:04:55 UTC.”
reviewerRemediation: upgrade to clean versions published after the compromiseCited sources give no upgrade guidance. A search summary says no clean successor was confirmed. That correction rests on search-result text and not a fetched page, so it is lower confidence.Proposed correction (not yet applied)and pin to package versions published before June 24, 2026 at 23:04:55 UTC, since no clean successor versions had been confirmed.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #3[unverifiable][awaiting moderator]in section: Payload Capabilities and Credential Theft
“Exfiltrated data was staged to repositories under the GitHub account liuende501, which hosted 236 repositories used as credential dead-drops.”
reviewerExfiltration account liuende501 hosted 236 repositories used as dead-dropsAccount name and repo count not found in the cited sources. StepSecurity describes exfiltration through the victim's own token, which conflicts with a single attacker account. - #4[unverifiable][awaiting moderator]in section: Threat Actor Attribution: TeamPCP and Shai-Hulud Framework
“The C2 domain git-tanstack[.]com was previously associated with TeamPCP operations.”
reviewerRussian-locale killswitch and C2 domain git-tanstack[.]com tied to TeamPCPDatadog page was not fetched (time). SafeDep body does not confirm it.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: Attack Overview
“The sole npm account present as a maintainer on all 20 affected packages was czirker (attributed to Clint Zirker)”
reviewerThe sole maintainer on all 20 packages was czirker, attributed to Clint ZirkerThe account handle is supported. Tying a real person's name to a compromised (victim) account was not found in fetched sources; this is a living-person risk, so the name should be removed. - #5[partially supported][awaiting moderator]in the summary
“The attack is attributed to tooling derived from the TeamPCP Shai-Hulud worm framework”
reviewerAttribution to Shai-Hulud-derived tooling by a possible copycat; same actor not assertedLink to Miasma is supported; direct TeamPCP attribution is not shown in the sources I read and is hedged elsewhere on the page.
confirmed
3 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Attack Overview
“At 23:04:55 UTC on June 24, 2026, 20 npm packages under the LeoPlatform/LeoInsights organization received malicious version updates in a coordinated burst spanning less than three seconds.”
reviewer20 npm packages compromised at 23:04:55 UTC on June 24, 2026 in a burst under three seconds; ~13,600 weekly downloadsCore facts match both primary sources. Minor discrepancy in secondary reporting (23 versions/6 s) does not override the researchers. - #6[confirmed][no action needed]in section: GitHub Repository Poisoning
“These branches contained weaponized 'Dependabot Updates' workflow files requesting id-token: write permissions”
reviewerOrphan branches with fake Dependabot workflows requesting id-token: write, about 15 minutes before publishSupported. The 22:50 timing was not visible in the extract. - #7[confirmed][no action needed]in section: Attack Vector: Phantom Gyp Technique
“The index.js file in each compromised package was replaced with an approximately 5.2 MB single-line obfuscated payload.”
reviewerbinding.gyp Phantom Gyp trigger, ~5.2 MB index.js, bun dependencyMatches.