Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp

A supply chain attack is actively spreading through the npm registry by abusing a file most security tooling never looks at: binding.gyp. Instead of relying on the well-monitored preinstall or postinstall lifecycle scripts, the malware ships a weaponized binding.gyp that triggers node-gyp to execute attacker-controlled code automatically during npm install. Snyk is tracking the incident as Node-gyp Supply Chain Compromise - June 2026, covering 57 affected packages across hundreds of malicious versions, all classified as Embedded Malicious Code at Critical severity. The payload harvests developer and CI/CD credentials across npm, GitHub, AWS, GCP, Azure, HashiCorp Vault, and Kubernetes, exfiltrates them through attacker-controlled GitHub repositories, injects GitHub Actions workflows for persistence, and self-propagates by republishing packages from any maintainer account it can reach. StepSecurity, which first reported the campaign, named the install-time technique "Phantom Gyp" and tracks the wider campaign as "Miasma," a descendant of the Shai-Hulud worm family. Code execution at install time through binding.gyp / node-gyp, not preinstall/postinstall Code execution at install time through binding.gyp / node-gyp, not preinstall/postinstall Snyk lists 57 affected packages. We confirmed the listed malicious versions are still resolvable on the public registry (for example, all four @vapi-ai/server-sdk versions return live tarballs from registry.npmjs.org), with…