Reported by 1 outlet

Timeline

1. original reporting

   Triple npm Supply Chain Onslaught — IronWorm, Phantom Gyp (Miasma), and Shai-Hulud Wave Hit Developer Ecosystems in 48 Hours

   malware.news · 131d ago · June 5th, 2026

   Three coordinated or coincident supply-chain campaigns struck npm within hours of each other, collectively compromising 100+ packages across maintainer accounts with overlapping TTPs indicating an escalating automated attack infrastructure against the software supply chain.

   1. IronWorm (36 packages) — Rust-based infostealer hiding behind an eBPF kernel rootkit, communicating over Tor. Targets 86 environment variables (OpenAI, AWS, Anthropic, npm credentials) and 20 credential files. Self-propagates via stolen npm Trusted Publishing tokens. Uses GitHub Actions build artifacts as dead-drop exfiltration to avoid C2 infrastructure entirely. Started from compromised account asteroiddao.

   2. Phantom Gyp / Miasma (57 packages, 286+ versions) — A new variant of the Miasma worm exploited npm's binding.gyp build configuration file to execute code during npm install without triggering conventional lifecycle script monitoring. Dubbed "Phantom Gyp", the 157-byte payload weaponizes node-gyp rebuild command substitution. The malware deploys the Bun runtime to evade Node.js detection, accesses GitHub Actions runner memory to recover masked secrets, and poisons AI coding environments (Claude Code, Cursor, VS Code configs). C2 uses GitHub account liuende501 (236 repos) as dead-drop storage with beacon keyword thebeautifulmarchoftime.

   3. Shai-Hulud Miasma Wave — Continuing the Red Hat compromise from earlier this week, hundreds of npm packages hit by the Shai-Hulud worm's automated propagation engine.

   Action: Developers should audit binding.gyp files in dependencies, rotate all npm tokens, enable 2FA, and check for GitHub commit authors named claude with impossible timestamps (13 years ago) — a tell for IronWorm compromise. Monitor for unexpected node-gyp rebuild invocations during install.

   ---