Critical Supply Chain Attack on npm’s binding.gyp Compromises Dozens of Packages

Key Takeaways

• A sophisticated self-replicating worm, dubbed “Phantom Gyp,” exploited a novel supply chain attack vector in the npm registry.
• The attack leveraged the binding.gyp configuration file to bypass standard security checks, compromising 57 npm packages across over 286 malicious versions on June 3, 2026.
• The malware, a variant of the Miasma worm, steals credentials from CI/CD environments (AWS, GCP, Azure, GitHub Actions, 1Password) and propagates itself by injecting malicious code into other packages.
• The threat actor also backdoored popular AI coding assistants (Claude Code, Cursor, Gemini) and left taunting messages referencing previous research.

Phantom Gyp: A New npm Supply Chain Threat Emerges

A stealthy, self-replicating worm has infiltrated the npm registry, employing an unconventional attack vector that circumvents many conventional security monitoring tools. Rather than embedding malicious scripts within typical package.json files, the attacker weaponized the diminutive binding.gyp configuration file. This innovative approach enabled the malicious code to execute immediately upon a developer issuing the npm install command.

This rapid and efficient supply chain attack unfolded across numerous maintainer accounts, affecting dozens of packages in a concentrated wave lasting less than two hours. The full extent of this campaign has been detailed in a report by researchers at StepSecurity, who have named this technique “Phantom Gyp.”

Attack Details and Impact

On June 3, 2026, the attack compromised 57 npm packages across more than 286 malicious versions. The initial target, struck at 23:30 UTC, was @vapi-ai/server-sdk, the official Vapi.ai voice AI server SDK, which boasts over 408,000 monthly downloads. Within an hour, the campaign expanded to include more than 50 additional packages maintained by ‘jagreehal’, including ai-sdk-ollama, with over 120,000 monthly downloads.

The StepSecurity analysis, shared with Cyber Security News (CSN), highlights how the attacker exploited a mere 157-byte binding.gyp file. This file triggered code execution during installation, effectively bypassing the preinstall and postinstall lifecycle checks that most security scanners are designed to detect. This method works because npm automatically invokes node-gyp rebuild when a binding.gyp file is present, interpreting it as an indication that the package contains native C or C++ code.

The attacker cleverly embedded a shell command using gyp’s native command substitution syntax. This silently launched a malicious payload while presenting a falsified source filename, ensuring the build process appeared error-free. Consequently, security tools focused solely on package.json for install scripts would detect no anomalies.

A significant indicator of compromise was the size discrepancy: the malicious root index.js file measured 4.5 MB, vastly larger than the legitimate package entry point of only 27 KB. The payload itself was highly obfuscated, employing four layers of defense including a ROT cipher, AES-128-GCM encryption, and a runtime-switching technique. This technique involved downloading the Bun JavaScript runtime in under one second to execute the final stage outside of Node.js, specifically designed to evade security tools monitoring only Node.js process activity.

Miasma Worm Variant and Attacker Motives

The deployed payload is a new variant of the Miasma worm, a self-propagating supply chain malware family. This particular variant had previously targeted 32 packages under the @redhat-cloud-services npm namespace just two days prior to the current attack. The attacker demonstrated a clear awareness of security research, leaving a taunting message in 195 GitHub repository descriptions: a reversed string that decodes to “Shai-Hulud: Here We Go Again.” This directly references StepSecurity’s earlier analysis of the Red Hat compromise, indicating a calculated and persistent threat actor.

Credential Theft, Worm Propagation, and AI Backdoors

Once activated, the malware functions as a sophisticated credential harvester, specifically tailored for CI/CD environments. It targets critical credentials such as AWS keys, GCP credentials, Azure tokens, HashiCorp Vault tokens, GitHub Actions secrets, and 1Password vaults. Notably, it scrapes GitHub Actions runner memory to extract masked secrets in their unmasked form, a technique previously observed in the May 2026 TanStack compromise. Stolen credentials are then encrypted and uploaded to programmatically created repositories under the attacker-controlled GitHub account liuende501.

The worm’s capabilities extend beyond credential theft. It leverages stolen npm tokens to enumerate all packages owned by a compromised maintainer, injects the binding.gyp payload into each, and then republishes them with forged SLSA provenance and Sigstore signing. This makes reinfected packages appear legitimate, even to tools designed to verify supply chain integrity.

Furthermore, the malware injects backdoor configuration files into popular AI coding assistants, including Claude Code, Cursor, and Gemini. This allows the attacker to subtly influence AI-assisted suggestions within poisoned projects, potentially introducing further malicious code or vulnerabilities.

What You Should Do

• Immediate Credential Rotation: Treat all credentials from compromised environments as stolen and rotate them without delay.
• Repository Audit: Conduct a thorough audit of all repositories and CI pipelines for any affected packages.
• Check for AI Assistant Backdoors: Look for injected AI assistant files in your project repositories, specifically .claude/setup.mjs, .cursor/rules/setup.mdc, and .vscode/setup.mjs.
• Network Blocking: Implement immediate containment by blocking outbound network access to github.com/liuende501 and the Bun download endpoint (https://github.com/oven-sh/bun/releases/download/bun-v1.3.13/bun-linux-x64-baseline.zip).
• Enhanced Scanning: Review and update security scanning tools to detect anomalies in configuration files like binding.gyp, not just package.json.
• Monitor for IoCs: Actively monitor your environment for the following Indicators of Compromise:

Indicators of Compromise (IoCs)

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.