Phantom Gyp technique

Named by 2 kept items in this workspace.

Search every workspace for Phantom Gyp technique. It matches the name as written, so it can find other things that share it.

The items that name it 2

jscrambler npm package publishes malicious preinstall binary
writeup2026-07-12
Technique name referenced in StepSecurity's Threat Center alert for technical analysis of the jscrambler compromise attack method.
Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
writeup2026-06-18
Technique name referenced by StepSecurity's Threat Center alert covering this campaign (57 affected packages, 286+ malicious versions)

All threat actors in this workspace.