2026-06-03 · 2026-Q2
node-gyp "Phantom Gyp" Self-Propagating npm Worm (Miasma)
Outside the model: Adjacent ecosystemAgent tooling was not the attack surface, so no layer applies.
- Fixable
- Architectural
- Vendor response
- Unknown
- In the wild
- Yes
- Actor
- Not applicable
Target
57 npm packages across hundreds of malicious versions; the largest AI target was `@vapi-ai/server-sdk` (Vapi.ai voice-AI SDK, ~86,500 weekly downloads), with poisoned versions 0.11.1, 0.11.2, 1.2.1, and 1.2.2
Impact
A weaponized `binding.gyp` makes node-gyp execute attacker code during the `npm install` configuration phase, bypassing pre/postinstall monitoring; it harvests npm, GitHub, AWS, GCP, Azure, Vault, and Kubernetes credentials, injects GitHub Actions workflows for persistence, and self-propagates
Root cause
Novel abuse of GYP command-expansion syntax in `binding.gyp` build hooks; a descendant of the Shai-Hulud and Miasma worm families
Sources
Catalog
Cite this: AgentProv incident record: node-gyp "Phantom Gyp" Self-Propagating npm Worm (Miasma) (2026-06-03). https://agentprov.com/incidents/2026-06-03-node-gyp-phantom-gyp-self-propagating-npm-worm-miasma