Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp
A novel npm worm abuses node-gyp's binding.gyp compilation step to execute code without lifecycle scripts—evading the standard mitigations that registries and lockdown tools rely on, while also persisting through GitHub token theft.
Summary written by editorial AI · Source link below
A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-propagates across maintainers.
Editorial Analysis
By hiding in native build configuration files rather than lifecycle scripts, this technique bypasses the very controls npm introduced after previous supply-chain incidents, demanding new detection strategies.
Audit binding.gyp files in native npm dependencies for unexpected shell commands, and enforce GitHub token scoping with short-lived credentials in CI/CD.
A new npm worm bypasses established supply-chain defences by hiding in native build files, requiring updated security controls across developer toolchains.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Snyk Blog in a new tab.
More from the DevSecOps Desk
- A Protected Browser Doesn't Mean Your Enterprise Is Remediated3d
- No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild4d
- Railway warns devs to rotate secrets after potential breach4d
- The Limits of Fingerprint Blocklists: A Reproducible Java Certificate Bypass5d
- eMudhra CA Incident: Sonatype's Assessment and Guidance5d