🧰 node-gyp

The items that name it 11

• @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow
  writeupas tools2026-08-28

  Build tool that evaluates binding.gyp; abused via a malicious condition traversing Python objects to reach os.system() and execute the payload

• Socket: npm v12 Ships With Install Scripts Off by Default
  articleas classification.technologies2026-07-15
• Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised
  writeupas classification.technologies2026-07-01
• Socket: Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages
  writeupas tools2026-06-27

  Native module build tool abused via binding.gyp trick ('Phantom Gyp') for install-time execution without preinstall/postinstall hooks

• JFrog: npm v12
  articleas classification.technologies2026-06-18
• Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files
  articleas classification.technologies2026-06-18
• The OpenSourceMalware Show #8
  talkas classification.technologies2026-06-11
• The Pros and Cons of NPM v12's Security Improvements
  articleas classification.technologies2026-06-10
• Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System
  writeupas tools2026-06-09

  cross-platform build tool bundled with npm that compiles native Node.js add-ons by reading and executing binding.gyp

• Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp
  writeupas classification.technologies2026-06-04
• VSCode Lifecycle Script Malware
  writeupas tools2026-05-16

  Used by native npm modules to compile against the local system during install