Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines via binding.gyp

What happened: On June 3, 2026, attackers published 286 malicious versions across 57 npm packages, deploying a self-replicating CI/CD worm that harvests credentials and spreads itself using a novel install-time execution technique that bypasses nearly every existing npm security defense. Chainguard customers: Not affected. Chainguard Libraries builds from source and does not consume registry tarballs. All 286 malicious versions were blocked in the Chainguard blocklist by 5:29 a.m. UTC on June 4. Packages affected: @vapi-ai/server-sdk, ai-sdk-ollama, autotel*, awaitly*, executable-stories*, node-env-resolver*, wrangler-deploy, and 46 additional packages across two maintainer accounts. Scale: 57 packages, 286+ malicious versions. @vapi-ai/server-sdk alone pulls ~408,000 monthly downloads; ai-sdk-ollama adds ~120,000. Risk: Critical. The malware steals credentials from npm, GitHub, AWS, GCP, Azure, HashiCorp Vault, Kubernetes, and RubyGems, then uses those credentials to publish poisoned versions of every package the victim maintains and inject malicious steps into every CI workflow they can reach. It also drops backdoor configurations into AI coding assistant directories, meaning the compromise can survive package removal entirely. What to do: Do not run anything on any machine or CI runner that executed npm install on an affected version since June 3. Rotate all credentials from a clean machine before touching the compromised environment.…