Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp
A novel npm worm abuses node-gyp's binding.gyp compilation step to execute code without lifecycle scripts—evading the standard mitigations that registries and lockdown tools rely on, while also persisting through GitHub token theft.
Summary written by editorial AI · Source link below
A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-propagates across maintainers.
Editorial Analysis
By hiding in native build configuration files rather than lifecycle scripts, this technique bypasses the very controls npm introduced after previous supply-chain incidents, demanding new detection strategies.
Audit binding.gyp files in native npm dependencies for unexpected shell commands, and enforce GitHub token scoping with short-lived credentials in CI/CD.
A new npm worm bypasses established supply-chain defences by hiding in native build files, requiring updated security controls across developer toolchains.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Snyk Blog in a new tab.
More from the DevSecOps Desk
- CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages20 Jul
- SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts19 Jul
- Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT17 Jul
- VulnHunter: Capital One's agentic AI code security tool17 Jul
- The Prover Is the Judge: Verified Security Software from AI Coding Agents in Ada/SPARK17 Jul