🎯 Phantom Gyp

The items that name it 8

• Socket: npm v12 Ships With Install Scripts Off by Default
  articleas classification.key entities2026-07-15
• jscrambler npm package publishes malicious preinstall binary
  writeupas classification.key entities2026-07-12
• Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised
  writeupas techniques2026-07-01

  Uses the node-gyp <!(...)> shell expansion inside the sources array of binding.gyp to execute arbitrary commands at install time without declaring any entry in the scripts block of package.json.

• Socket: Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages
  writeupas classification.key entities2026-06-27
• Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files
  articleas techniques2026-06-18

  Miasma npm technique using a 157-byte malicious binding.gyp file that triggers code execution during npm install through the native build step, bypassing install-script security checks entirely

• Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
  writeupas classification.key entities2026-06-18
• Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp
  writeupas classification.key entities2026-06-04
• The OpenSourceMalware Show #7
  talkas classification.key entities2026-06-03