This page may contain stale information. Last updated: 2026-06-07
Definition
Phantom Gyp is a miasma-worm attack technique abusing 157-byte binding.gyp files to trigger code execution during npm install, bypassing security tools that monitor preinstall/postinstall lifecycle scripts.
Key Points
- Used in June 2026 Miasma campaign extending from Red Hat npm (June 1) to Microsoft GitHub repos (June 5)
- Alternative to monitored install scripts — exploits native node-gyp build process
- Part of self-spreading worm propagation across npm, RubyGems, PyPI, and GitHub