Ongoing NPM supply chain attack uses binding.gyp to spread like a worm (opens in new tab)

Covers Miasma NPM Supply Chain Attack: Self-Spreading Worm via Phantom GypCovered by stepsecurity.ioDiscussed on Hacker News

Summary Packages published from this repository contain a malicious binding.gyp and index.js. Anyone running npm install or npm update against any version of the affected packages will trigger exec...

Read the original article

Sign in to keep reading the full article.

Sign Up Log In

Covered in 1 article

stepsecurity.io·

Miasma NPM Supply Chain Attack: Self-Spreading Worm via Phantom Gyp

Discussed on Hacker News