--- title: "Miasma 'Phantom Gyp' npm Worm Abuses binding.gyp - 57 Packages, 286 Versions, Vapi.ai SDK Hit" description: "The Miasma 'Phantom Gyp' npm worm abuses a 157-byte binding.gyp to run code at install, hitting 57 packages across 286+ versions in under two hours." url: "https://anomity.ai/blog/miasma-phantom-gyp-npm-worm-binding-gyp/" source: html --- On this page - What happened - Why this is an agentic-endpoint risk - How Anomity surfaces and governs it - What to check across your fleet - Frequently asked questions [← Back to blog](https://anomity.ai/blog/) - Home - Blog - Miasma 'Phantom Gyp' npm Worm Abuses binding.gyp - 57 Packages, 286 Versions, Vapi.ai SDK Hit ![Anomity robot illustrating Miasma 'Phantom Gyp' npm Worm Abuses binding.gyp - 57 Packages, 286 Versions, Vapi.ai SDK Hit] Advisory Critical # Miasma 'Phantom Gyp' npm Worm Abuses binding.gyp - 57 Packages, 286 Versions, Vapi.ai SDK Hit Anomity Research Anomity Threat Research · Jun 4, 2026 · 6 min read Share: Copied AI Supply-Chain Attacks · Critical · Miasma worm 'Phantom Gyp' (no single CVE) · Jun 4, 2026 Affected 57 npm packages across 286+ malicious versions including @vapi-ai/server-sdk (408,000+ monthly downloads) and 32 @redhat-cloud-services packages Disclosed in **early June 2026**, the **Miasma worm's 'Phantom Gyp' variant** abuses a **157-byte binding.gyp file** to trigger code execution during **npm install**, bypassing scanners that watch only for **preinstall** and **postinstall** script abuse in **package.json**. In a rolling campaign lasting **under two hours** it compromised **57 npm packages across 286+ malicious versions**. This advisory covers what happened with the **Miasma binding.gyp npm worm** and how to inventory and govern the install-time hook it abuses. ## What happened The **Miasma binding.gyp npm worm** is a self-replicating supply-chain payload whose **'Phantom Gyp'** variant abuses **binding.gyp** - the build configuration **node-gyp** reads to compile native add-ons - to run code during **npm install**. Because the execution vector is a **native-build hook** rather than a script field, it bypasses scanners that watch only for **preinstall** and **postinstall** abuse in **package.json**. The malicious file is just **157 bytes**, and there is **no single CVE**. In a rolling campaign lasting **under two hours**, Miasma compromised **57 npm packages across 286+ malicious versions**. It began with **32 packages under the @redhat-cloud-services namespace** trojanized on **June 1, 2026**. The largest victim was **@vapi-ai/server-sdk**, the official **Vapi.ai voice-AI server SDK** with **408,000+ monthly downloads**, first hit at **23:30 UTC on June 3, 2026**. An infected install steals credentials and replicates, seeding further trojanized publishes across the registry. Miasma exfiltrates without a fixed command-and-control server. The payload **creates a new GitHub repository on the fly** and uploads stolen secrets as **encrypted JSON**, using GitHub itself as a dead-drop channel. Exfiltration was traced to the GitHub account **liuende501**, hosting **236 dead-drop repositories**. The worm also crossed into GitHub automation: **AI coding-agent hooks planted in Azure/durabletask** led GitHub to disable **73 Microsoft repositories within 105 seconds**. Remediation requires **auditing binding.gyp files in dependencies**, **pinning versions**, and **rotating GitHub, npm, and cloud tokens**. ## Why this is an agentic-endpoint risk Miasma lives in the layer your other controls were never built to inventory. The execution vector is a **build hook** in a dependency, and the worm's escalation into **AI coding-agent hooks** in Azure/durabletask is the same pattern: a hook that runs code on someone else's behalf, on the endpoint, before anyone reviews it. **Hooks** are one of the [eight AI artifact types](https://anomity.ai/#features) Anomity tracks per endpoint - alongside AI agents, MCP servers, extensions, skills, plugins, secrets, and CLIs - adopted bottom-up the way [AI agents became the new shadow IT](https://anomity.ai/blog/ai-agents-are-the-new-shadow-it/). This exposure is hard to see from the tooling you already run. The **npm install** looks like ordinary developer activity to network monitoring, **node-gyp** compiling a native add-on looks legitimate to EDR, and DLP sees nothing at rest because the stolen secrets leave as **encrypted JSON to a fresh GitHub repository** that resembles routine API traffic. Script-only scanners read **package.json** lifecycle fields and never open **binding.gyp**. The question is not whether one package is patched - the worm spans **286+ versions** and replicates - it is which endpoints ran an affected install and **what those hooks were allowed to do**. It shares a root cause with the sibling [Shai-Hulud 2 npm worm credential stealer](https://anomity.ai/blog/shai-hulud-2-npm-worm-credential-stealer/) advisory: a self-replicating payload that turns an install hook into credential theft. ## How Anomity surfaces and governs it With a worm that spans hundreds of versions and replicates as it goes, chasing a patched version is not the durable control. Inventory the hooks that run code on your endpoints and govern what they do. Anomity does that in three steps. First, **inventory**. Anomity inventories **hooks, AI agents, MCP servers, and CLIs** on every managed endpoint as part of the [eight AI artifact types](https://anomity.ai/#features) it tracks, then classifies them - including the **AI coding-agent hooks** Miasma planted - so you can find every place that runs code on someone else's behalf. Anomity collects **metadata only**, and secrets such as **GitHub, npm, and cloud tokens** are **redacted on the endpoint** before anything leaves it, so a worm reading them at install time has nothing centralized to capture. Second, **decide at the hook**. On agents that expose a hook - for example, the **Claude Code PreToolUse** event - Anomity evaluates each tool call against your policy and returns **allow, deny, or log** before the call runs. A hook reaching for a credential, spawning a process to compile a native add-on, or pushing to a freshly created GitHub repository can be **denied at the boundary** - which is what [runtime governance](https://anomity.ai/#runtime-governance) provides for a payload that runs before any scanner reviews it, catching the **binding.gyp** install-time code that script-only scanning misses. Third, **keep the record**. Anomity **logs the tool calls and secret access an agent performs**, so a hook reaching a token or creating a repository is recorded against a [queryable 90-day audit trail](https://anomity.ai/#outcomes), and decisions route to **SIEM, Slack, email, or Jira**. When a worm like Miasma lands, you can answer which endpoints ran an affected install and what their hooks were allowed to do - from a record, not a guess. Anomity is **SOC 2 Type II** and complements your **Network, EDR, DLP, and GRC** tooling. See how it fits in [how it works](https://anomity.ai/#how-it-works) and how it [compares to existing controls](https://anomity.ai/#compare). > You can't govern what you can't see. The Anomity principle ## What to check across your fleet - Inventory every endpoint and pipeline that ran npm install in the June 1–3, 2026 window, and confirm none pulled an affected @vapi-ai/server-sdk, @redhat-cloud-services package, or any of the 57 trojanized packages. - Audit binding.gyp files in your dependency tree - including transitive ones - for unexpected build commands, since Phantom Gyp hides execution in the native-build hook, not package.json scripts. - Pin npm dependencies to known-good versions and verify lockfile integrity, so a worm spanning 286+ versions cannot reach an install through a floating range. - Rotate GitHub, npm, and cloud tokens reachable from any potentially infected endpoint, and review GitHub for unexpected repositories that could serve as encrypted-JSON dead drops. - Inventory the install-time and AI coding-agent hooks across your fleet - the surface Miasma abused in Azure/durabletask - using the hook and artifact inventory . - Confirm install-time and agent hooks are evaluated at a hook with allow/deny/log , so credential reads and pushes to fresh repositories are stopped before they run. - Verify every tool call and secret access is written to a 90-day audit trail and routed to your SIEM, so you can answer scope when the next npm worm lands. - Cross-reference this inventory against the sibling Shai-Hulud 2 npm worm credential stealer advisory to find endpoints exposed to more than one install-time path. Miasma's Phantom Gyp variant is a reminder that install-time execution does not need a script field - a 157-byte binding.gyp and a build hook are enough, and a self-replicating worm turns one infected install into a registry-wide problem. Audit binding.gyp files, pin versions, and rotate GitHub, npm, and cloud tokens, then inventory the hooks your endpoints run and govern what those hooks do at the boundary. For the full picture of these campaigns and how to defend against them, see the pillar guide on [AI supply-chain attacks: a defender's guide](https://anomity.ai/blog/ai-supply-chain-attacks-defenders-guide/). To see Anomity govern the hook layer across your fleet, [book a demo](https://anomity.ai/#early-access). Share: Copied ## Frequently asked questions What is the Miasma 'Phantom Gyp' npm worm? Miasma is a self-replicating npm worm whose 'Phantom Gyp' variant, disclosed in early June 2026, abuses a 157-byte binding.gyp file to trigger code execution during npm install. binding.gyp is the build configuration node-gyp reads to compile native add-ons, so the install-time execution runs through the native-build hook rather than the preinstall or postinstall script fields in package.json that scanners usually watch. In a rolling campaign lasting under two hours it compromised 57 npm packages across 286+ malicious versions. The payload steals credentials and replicates itself, so a single infected install can seed further trojanized publishes across the registry. Which packages did Miasma compromise, and how big was the blast radius? The campaign trojanized 57 npm packages across 286+ malicious versions. The largest victim was @vapi-ai/server-sdk, the official Vapi.ai voice-AI server SDK with 408,000+ monthly downloads, first hit at 23:30 UTC on June 3, 2026. That came after 32 packages under the @redhat-cloud-services namespace were trojanized on June 1, 2026. Miasma also crossed into GitHub automation: AI coding-agent hooks planted in Azure/durabletask led GitHub to disable 73 Microsoft repositories within 105 seconds. Any endpoint or pipeline that installed an affected version in the window is potentially exposed and should rotate credentials. How does Miasma exfiltrate stolen credentials without a fixed C2? Miasma has no fixed command-and-control server. Instead, the payload creates a new GitHub repository on the fly and uploads stolen secrets as encrypted JSON, using GitHub itself as the dead-drop channel. Exfiltration was traced to the GitHub account liuende501, which hosted 236 dead-drop repositories. Because the traffic is ordinary GitHub API activity to an attacker-controlled repository, it blends into normal developer and CI behavior and offers no static C2 address to block. The durable response is to rotate GitHub, npm, and cloud tokens, audit binding.gyp files in dependencies, and pin versions. Why do script-only npm scanners miss the Phantom Gyp variant? Many supply-chain scanners flag malicious behavior by inspecting the preinstall and postinstall lifecycle scripts declared in package.json. Phantom Gyp does not use those fields. Its execution vector is binding.gyp, the native-build configuration node-gyp processes during install to compile add-ons, so the code runs through a build hook the script-only checks never read. The fix is to audit binding.gyp files inside dependencies, pin versions, and govern install-time execution at the endpoint. Anomity inventories the AI artifact and hook layer and applies allow/deny/log on the agent hook, catching install-time execution that script-only scanning misses. ## Related [Advisory High ### Plugin4Shell - A Branch Named Like a Commit Broke Plugin SHA Pinning in Four Coding Agents Plugin4Shell let a plugin owner swap reviewed code under an intact SHA pin. Auto-update made it zero-click. Two agents patched, two never will. Anomity Research · Oct 2, 2026 · Plugin4Shell (AIR, 2026-09-17); no CVE assigned](https://anomity.ai/blog/plugin4shell-coding-agent-plugin-sha-pinning-bypass/) [Advisory High ### OpenClaw 2.0: What the Biggest Rewrite Yet Changes for Skill Supply-Chain Risk OpenClaw 2.0 landed on 30 August 2026 as the project's largest rewrite. Unit 42 and Backslash research shows the skill supply chain it inherits is still delivering malware - and our own scans separate the official skills from the ecosystem around them. Anomity Research · Sep 2, 2026 · No CVE. OpenClaw 2.0 (release notes 2026.8.1), 30 August 2026; Unit 42 skill analysis (February-May 2026); Backslash Security risk review (4 June 2026)](https://anomity.ai/blog/openclaw-2-0-security-skill-supply-chain/) [Advisory High ### MCPJacking: How Expired Domains Take Over Registry MCP Servers MCPJacking hijacks listed MCP servers by reclaiming their expired domains. AIR Security reports 155 hijackable entries in the official MCP registry. Anomity Research · Aug 29, 2026 · MCPJacking (AIR Security, August 2026; no CVE published)](https://anomity.ai/blog/mcpjacking-expired-domain-mcp-registry-hijack/) ## Structured data ```json { "@context": "https://schema.org", "@type": "TechArticle", "headline": "Miasma 'Phantom Gyp' npm Worm Abuses binding.gyp - 57 Packages, 286 Versions, Vapi.ai SDK Hit", "description": "The Miasma 'Phantom Gyp' npm worm abuses a 157-byte binding.gyp to run code at install, hitting 57 packages across 286+ versions in under two hours.", "datePublished": "2026-06-04", "dateModified": "2026-06-04", "author": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ] }, "publisher": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ], "logo": { "@type": "ImageObject", "url": "https://anomity.ai/icon-512.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://anomity.ai/blog/miasma-phantom-gyp-npm-worm-binding-gyp/" }, "image": { "@type": "ImageObject", "url": "https://anomity.ai/assets/blog/covers/skills-supply-chain.jpg", "width": 1200, "height": 630 }, "articleSection": "AI Supply-Chain Attacks", "url": "https://anomity.ai/blog/miasma-phantom-gyp-npm-worm-binding-gyp/", "keywords": "Miasma binding.gyp npm worm, Miasma worm 'Phantom Gyp' (no single CVE), Miasma worm, Phantom Gyp, binding.gyp, npm supply chain, self-replicating worm, credential theft, Vapi.ai, agentic AI security" } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the Miasma 'Phantom Gyp' npm worm?", "acceptedAnswer": { "@type": "Answer", "text": "Miasma is a self-replicating npm worm whose 'Phantom Gyp' variant, disclosed in early June 2026, abuses a 157-byte binding.gyp file to trigger code execution during npm install. binding.gyp is the build configuration node-gyp reads to compile native add-ons, so the install-time execution runs through the native-build hook rather than the preinstall or postinstall script fields in package.json that scanners usually watch. In a rolling campaign lasting under two hours it compromised 57 npm packages across 286+ malicious versions. The payload steals credentials and replicates itself, so a single infected install can seed further trojanized publishes across the registry." } }, { "@type": "Question", "name": "Which packages did Miasma compromise, and how big was the blast radius?", "acceptedAnswer": { "@type": "Answer", "text": "The campaign trojanized 57 npm packages across 286+ malicious versions. The largest victim was @vapi-ai/server-sdk, the official Vapi.ai voice-AI server SDK with 408,000+ monthly downloads, first hit at 23:30 UTC on June 3, 2026. That came after 32 packages under the @redhat-cloud-services namespace were trojanized on June 1, 2026. Miasma also crossed into GitHub automation: AI coding-agent hooks planted in Azure/durabletask led GitHub to disable 73 Microsoft repositories within 105 seconds. Any endpoint or pipeline that installed an affected version in the window is potentially exposed and should rotate credentials." } }, { "@type": "Question", "name": "How does Miasma exfiltrate stolen credentials without a fixed C2?", "acceptedAnswer": { "@type": "Answer", "text": "Miasma has no fixed command-and-control server. Instead, the payload creates a new GitHub repository on the fly and uploads stolen secrets as encrypted JSON, using GitHub itself as the dead-drop channel. Exfiltration was traced to the GitHub account liuende501, which hosted 236 dead-drop repositories. Because the traffic is ordinary GitHub API activity to an attacker-controlled repository, it blends into normal developer and CI behavior and offers no static C2 address to block. The durable response is to rotate GitHub, npm, and cloud tokens, audit binding.gyp files in dependencies, and pin versions." } }, { "@type": "Question", "name": "Why do script-only npm scanners miss the Phantom Gyp variant?", "acceptedAnswer": { "@type": "Answer", "text": "Many supply-chain scanners flag malicious behavior by inspecting the preinstall and postinstall lifecycle scripts declared in package.json. Phantom Gyp does not use those fields. Its execution vector is binding.gyp, the native-build configuration node-gyp processes during install to compile add-ons, so the code runs through a build hook the script-only checks never read. The fix is to audit binding.gyp files inside dependencies, pin versions, and govern install-time execution at the endpoint. Anomity inventories the AI artifact and hook layer and applies allow/deny/log on the agent hook, catching install-time execution that script-only scanning misses." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://anomity.ai/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://anomity.ai/blog/" }, { "@type": "ListItem", "position": 3, "name": "Miasma 'Phantom Gyp' npm Worm Abuses binding.gyp - 57 Packages, 286 Versions, Vapi.ai SDK Hit", "item": "https://anomity.ai/blog/miasma-phantom-gyp-npm-worm-binding-gyp/" } ] } ```