Miasma NPM Supply Chain Attack: Self-Spreading Worm via Phantom Gyp (opens in new tab)

self-replicating worm is spreading across the npm registry using binding.gyp, a file that triggers code execution during npm install without touching package.json scripts. The attack bypasses conventional security tools and has already compromised dozens of packages across multiple maintainer accounts.