{"investigation":{"slug":"phantom-gyp-npm-supply-chain-attack-june-2026","entity_name":"Phantom Gyp npm Supply Chain Attack (June 2026)","trust_score":1,"severity_base":null,"score_modifier":0,"confidence":0.92,"status":"published","content_type":"investigation","summary":"On June 3, 2026, attackers published 286 malicious versions across 57 npm packages in under two hours, using a technique researchers named 'Phantom Gyp' that abused binding.gyp native-build configuration files to execute code during npm install without any entry in package.json lifecycle scripts, evading tooling that audits those scripts. The campaign, tracked as 'Miasma' and described as the eighth wave of the Shai-Hulud worm lineage, harvested CI/CD and developer credentials (npm, GitHub, AWS, GCP, Azure, HashiCorp Vault, Kubernetes, password managers), self-propagated using stolen publishing tokens with forged SLSA provenance, and planted backdoors in AI coding assistant configuration files. It followed a June 1 Miasma wave against 32 @redhat-cloud-services packages; the highest-profile Phantom Gyp victim, @vapi-ai/server-sdk (408,000+ monthly downloads), had its four malicious versions removed with zero recorded downloads according to Vapi.","sections":[{"content":"On June 3, 2026, beginning at approximately 23:30 UTC, threat actors published 286 malicious package versions across 57 npm packages in a rolling campaign that concluded in under two hours. Security firm StepSecurity named the install-time technique 'Phantom Gyp' (a name also used by Corgea) and tracks the broader campaign as 'Miasma', which it characterizes as a descendant of the Shai-Hulud self-replicating worm family active since at least September 2025; the June 3 event is described as the eighth distinct attack in that lineage. The Miasma campaign unfolded in two main waves in early June 2026: a June 1 wave against the @redhat-cloud-services npm namespace (see below) and the larger June 3 Phantom Gyp wave. The threat actor group known as TeamPCP had published the full Mini Shai-Hulud worm source code to GitHub on May 12, 2026, alongside BreachForums posts encouraging independent campaigns, significantly complicating attribution for subsequent waves. The June 3 wave began with four malicious versions of @vapi-ai/server-sdk, the official Vapi.ai voice AI server SDK (408,000+ monthly downloads); within under two hours, 50+ additional packages were poisoned, including ai-sdk-ollama (120,000+ monthly downloads) and approximately 55 packages across the autotel/awaitly/executable-stories/node-env-resolver families maintained under the npm account 'jagreehal'. Targets included developers building voice AI applications, general JavaScript tooling and CI/CD automation.","heading":"Attack Overview","sources":[{"url":"https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/","name":"Node-gyp Supply Chain Compromise: Self-Propagating npm Worm via binding.gyp — Snyk","type":"research","credibility":2},{"url":"https://corgea.com/research/miasma-phantom-gyp-npm-worm-vapi-ai-sdk-ollama-june-2026","name":"Phantom Gyp Miasma hit Vapi, ai-sdk-ollama, and 55 more npm packages — Corgea","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm","name":"Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp — StepSecurity","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/06/ironworm-and-new-miasma-worm-variant.html","name":"IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks — The Hacker News","type":"news_article","credibility":2},{"url":"https://socprime.com/active-threats/shai-hulud-here-we-go-again-worm-by-teampcp-hits-npm-and-pypi/","name":"Shai-Hulud Worm Hits NPM and PyPI Supply Chains — SOC Prime","type":"research","credibility":2},{"url":"https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages","name":"Miasma: Supply Chain Attack Targeting RedHat npm Packages — Wiz Blog","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/","name":"Shai-Hulud — Miasma: The Spreading Blight Hits Red Hat npm Packages — JFrog Security Research","type":"research","credibility":2}],"severity":"critical"},{"content":"On June 1, 2026, a Miasma variant compromised 32 packages across 96 malicious versions in the official @redhat-cloud-services npm namespace, reportedly within 72 seconds. The compromise was carried out via a hijacked Red Hat employee GitHub account, which injected malicious OIDC token-requesting workflows and published packages bearing valid SLSA v1 provenance attestations; a timeline entry on one source page describes the injected mechanism as malicious preinstall hooks. Affected packages included @redhat-cloud-services/types, @redhat-cloud-services/frontend-components, @redhat-cloud-services/javascript-clients, @redhat-cloud-services/compliance-client, @redhat-cloud-services/rbac-client and @redhat-cloud-services/insights-client, among others. Reports differ on the download exposure: a combined weekly download count of approximately 116,991 according to The Hacker News, versus packages 'averaging ~80,000 weekly downloads' as characterized from Wiz, ReversingLabs and Cybersecurity Dive reporting. Wiz Research identified this wave and reported that most malicious versions were revoked by 14:00 UTC that day, with a second sub-wave discovered on June 4. Red Hat confirmed that no official Red Hat products were affected. The wave demonstrated that even packages with verifiable SLSA attestations can be compromised when the signing identity itself is under attacker control.","heading":"Preceding Wave: @redhat-cloud-services Compromise (June 1, 2026)","sources":[{"url":"https://thehackernews.com/2026/06/miasma-supply-chain-attack-compromises.html","name":"Miasma Supply Chain Attack Compromises Red Hat npm Packages — The Hacker News","type":"news_article","credibility":2},{"url":"https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages","name":"Miasma: Supply Chain Attack Targeting RedHat npm Packages — Wiz Blog","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/","name":"Shai-Hulud — Miasma: The Spreading Blight Hits Red Hat npm Packages — JFrog Security Research","type":"research","credibility":2},{"url":"https://www.cybersecuritydive.com/news/dozens-red-hat-npm-packages-supply-chain-attack/821723/","name":"Dozens of Red Hat npm packages targeted in supply chain attack — Cybersecurity Dive","type":"news_article","credibility":2},{"url":"https://www.reversinglabs.com/blog/npm-bindinggyp-cicd-secrets","name":"How 56 npm packages used binding.gyp to steal CI/CD secrets — ReversingLabs","type":"research","credibility":2}],"severity":"high"},{"content":"Rather than using the preinstall, postinstall or prepare lifecycle hooks in package.json, which security tooling conventionally audits, the attacker weaponized binding.gyp, a native build configuration file consumed by node-gyp. When npm detects a binding.gyp file in a package root, it automatically invokes 'node-gyp rebuild' as part of native module compilation. The attackers embedded a 157-byte malicious binding.gyp whose 'sources' field used GYP's command substitution syntax ' /dev/null 2>&1 && echo stub.c)', causing node-gyp to execute the attacker's index.js before the build phase completes. A 'type: none' target ensured no native compilation was actually needed, meaning the shell expansion was the file's sole purpose. Because no entry appeared in the package.json scripts field, the technique bypassed tools that scan package.json lifecycle hooks, which were the dominant detection approach for supply chain malware at the time. The payload resided in a root-level index.js of approximately 4.5 MB, significantly larger than typical package entry points and never imported by normal application code.","heading":"Phantom Gyp Technique","sources":[{"url":"https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm","name":"Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp — StepSecurity","type":"research","credibility":2},{"url":"https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/","name":"Node-gyp Supply Chain Compromise — Snyk","type":"research","credibility":2},{"url":"https://www.chainguard.dev/unchained/chainguard-artifacts-safe-from-miasma-phantom-gyp-npm-attack","name":"Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions — Chainguard","type":"research","credibility":2},{"url":"https://www.reversinglabs.com/blog/npm-bindinggyp-cicd-secrets","name":"How 56 npm packages used binding.gyp to steal CI/CD secrets — ReversingLabs","type":"research","credibility":2},{"url":"https://corgea.com/research/miasma-phantom-gyp-npm-worm-vapi-ai-sdk-ollama-june-2026","name":"Phantom Gyp Miasma hit Vapi, ai-sdk-ollama, and 55 more npm packages — Corgea","type":"research","credibility":2}],"severity":"critical"},{"content":"The 4.5 MB obfuscated index.js loader used a four-stage decryption and execution chain designed to resist static analysis. Stage 1 decoded approximately 1.3–1.4 million character codes via a ROT-N Caesar cipher (rotations observed between ROT-9 and ROT-20 across samples) wrapped in an eval() call, wrapping an AES-128-GCM encrypted payload. Stage 2 applied AES-128-GCM decryption using embedded keys and initialization vectors. Stage 3 downloaded a standalone Bun v1.3.13 runtime binary from GitHub releases and executed subsequent code outside the Node.js process, evading Node.js-scoped process monitoring. Stage 4 ran a 668 KB main payload obfuscated with Obfuscator.io, with a 2,306-entry encrypted string table containing credential harvesting logic and worm propagation routines. Unique AES keys per package family further complicated hash-based detection across victims. Runtime analysis by StepSecurity's Harden-Runner traced the kill chain over 17.6 seconds: node-gyp rebuild triggered at T+2.1s, Bun downloaded and extracted in under one second at T+3.9s, credential theft via 'gh auth token' at T+8.3s, privileged memory scraping via 'sudo python3' at T+8.5s, and exfiltration API calls beginning at T+13.4s (the survivor page describes this as roughly 13.4 seconds from 'npm install' to active credential exfiltration).","heading":"Payload Architecture and Obfuscation","sources":[{"url":"https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm","name":"Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp — StepSecurity","type":"research","credibility":2},{"url":"https://www.reversinglabs.com/blog/npm-bindinggyp-cicd-secrets","name":"How 56 npm packages used binding.gyp to steal CI/CD secrets — ReversingLabs","type":"research","credibility":2},{"url":"https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/","name":"Node-gyp Supply Chain Compromise — Snyk","type":"research","credibility":2},{"url":"https://www.chainguard.dev/unchained/chainguard-artifacts-safe-from-miasma-phantom-gyp-npm-attack","name":"Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions — Chainguard","type":"research","credibility":2}],"severity":"critical"},{"content":"The stealer module was purpose-built for CI/CD environments. Cloud provider credentials targeted include AWS access keys, session tokens and IMDSv2 metadata (169.254.169.254); GCP service account keys and application default credentials; and Azure service principal secrets, managed identity tokens, OIDC tokens and IMDS endpoint data. CI/CD systems targeted include GitHub Actions (ACTIONS_ID_TOKEN_REQUEST_TOKEN and OIDC tokens, plus GitHub personal access tokens), GitLab CI, Travis CI, CircleCI, Jenkins and Buildkite. The payload extracted GitHub Actions masked secrets in unmasked form by reading runner process memory directly (from /proc/[PID]/mem, using a shell pattern of the form 'tr -d \\0 | grep -aoE'), bypassing GitHub's secret masking, which operates at the logging layer rather than the memory layer; the same technique was also observed in the TanStack compromise in May 2026. According to StepSecurity, 'every secret the runner can access should be considered compromised' for anyone who installed an affected package in CI. Secret management targets included HashiCorp Vault tokens and Kubernetes service account tokens. Local developer stores targeted include npm publish tokens and ~/.npmrc, ~/.aws/credentials, ~/.kube/config, SSH private keys (~/.ssh/id_*), .env files throughout project directories, Docker configuration, RubyGems API keys, password managers (1Password, pass, gopass) and communication tools (Signal, Telegram, Discord, Slack). No verified source confirmed direct targeting of cryptocurrency wallet keystore files (e.g., ~/.solana or ~/.ethereum) in this campaign, though the broad sweep of .env files and local credential stores poses an indirect risk to developers storing private keys or seed phrases there.","heading":"Credential Harvesting Scope","sources":[{"url":"https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm","name":"Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp — StepSecurity","type":"research","credibility":2},{"url":"https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/","name":"Node-gyp Supply Chain Compromise — Snyk","type":"research","credibility":2},{"url":"https://www.ox.security/blog/600000-monthly-downloads-affected-miasma-supply-chain-attack-is-back-on-npm/","name":"600,000 Monthly Downloads Affected: Miasma Supply Chain Attack Is Back on npm — OX Security","type":"research","credibility":2},{"url":"https://www.reversinglabs.com/blog/npm-bindinggyp-cicd-secrets","name":"How 56 npm packages used binding.gyp to steal CI/CD secrets — ReversingLabs","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/","name":"Shai-Hulud — Miasma: The Spreading Blight Hits Red Hat npm Packages — JFrog Security Research","type":"research","credibility":2},{"url":"https://corgea.com/research/miasma-phantom-gyp-npm-worm-vapi-ai-sdk-ollama-june-2026","name":"Phantom Gyp Miasma hit Vapi, ai-sdk-ollama, and 55 more npm packages — Corgea","type":"research","credibility":2}],"severity":"critical"},{"content":"Stolen npm tokens were validated via registry.npmjs.org/-/whoami and then used to enumerate every package owned by the compromised maintainer account; the worm downloaded each package, injected the malicious binding.gyp and obfuscated index.js, and republished using the stolen token. When GitHub Actions OIDC tokens were available, the worm requested signing certificates from Fulcio, created transparency log entries on Rekor and generated complete Sigstore SLSA v1 provenance attestations for the repackaged versions, making trojanized packages appear to have legitimate provenance to automated verification tools. On GitHub, the worm used stolen personal access tokens to commit backdoor files to victim repositories via the GraphQL API and injected malicious steps into GitHub Actions workflow files it could reach. On RubyGems, it injected equivalent code into 'extconf.rb', the Ruby native-extension build file that mirrors binding.gyp's role; the payload also contained templates for Makefile.PL (Perl) and CMakeLists.txt, indicating intent to spread beyond npm. The inflated, discontinuous version numbers across the autotel family were consistent with automated republishing by the worm's npm propagation engine.","heading":"Self-Propagation: Worm Mechanics","sources":[{"url":"https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm","name":"Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp — StepSecurity","type":"research","credibility":2},{"url":"https://corgea.com/research/miasma-phantom-gyp-npm-worm-vapi-ai-sdk-ollama-june-2026","name":"Phantom Gyp Miasma hit Vapi, ai-sdk-ollama, and 55 more npm packages — Corgea","type":"research","credibility":2},{"url":"https://blog.securityjoes.com/post/shai-hulud-miasma-when-a-supply-chain-worm-learned-to-hijack-ai-coding-agents","name":"Shai-Hulud: Miasma — When a Supply-Chain Worm Learned to Hijack AI Coding Agents — Security Joes","type":"research","credibility":2},{"url":"https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages","name":"Miasma: Supply Chain Attack Targeting RedHat npm Packages — Wiz Blog","type":"research","credibility":2},{"url":"https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/","name":"Node-gyp Supply Chain Compromise — Snyk","type":"research","credibility":2}],"severity":"critical"},{"content":"The campaign injected persistent backdoor instructions into AI coding assistant and IDE configuration files: '.claude/setup.mjs' (Anthropic Claude Code), '.cursor/rules/setup.mdc' (Cursor), '.vscode/tasks.json' with 'runOn: folderOpen' (Visual Studio Code) and '.gemini/' configuration files. These execute whenever developers open affected projects, turning the development environment into a persistence and re-infection vector; the hooks run via 'bun run' rather than Node.js, aiding evasion. An 'update-monitor' daemon polled GitHub for commits matching the keyword 'firedalazer' and executed RSA-signed payloads from discovered URLs via eval() in the global scope. Sources differ on the token-revocation threat: StepSecurity/ReversingLabs/JFrog-based reporting describes a 'gh-token-monitor' dead-man's switch that checked stolen GitHub tokens every 60 seconds with a 72-hour TTL and executed 'rm -rf ~/' on the victim machine if a token was revoked, whereas other reporting (StepSecurity/Snyk/OX Security, as summarized on the survivor page) says researchers assessed the embedded message 'IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner' as intimidation rather than a credible capability. JFrog's analysis of the June 6 'Hades' variant also documented AI prompt injection targeting Cursor, GitHub Copilot and Claude assistants via jailbreak prompts embedded in repository rule files.","heading":"Persistence and AI Coding Assistant Backdoors","sources":[{"url":"https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm","name":"Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp — StepSecurity","type":"research","credibility":2},{"url":"https://blog.securityjoes.com/post/shai-hulud-miasma-when-a-supply-chain-worm-learned-to-hijack-ai-coding-agents","name":"Shai-Hulud: Miasma — When a Supply-Chain Worm Learned to Hijack AI Coding Agents — Security Joes","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/","name":"Shai-Hulud — Miasma: The Spreading Blight Hits Red Hat npm Packages — JFrog Security Research","type":"research","credibility":2},{"url":"https://www.reversinglabs.com/blog/npm-bindinggyp-cicd-secrets","name":"How 56 npm packages used binding.gyp to steal CI/CD secrets — ReversingLabs","type":"research","credibility":2},{"url":"https://www.ox.security/blog/600000-monthly-downloads-affected-miasma-supply-chain-attack-is-back-on-npm/","name":"600,000 Monthly Downloads Affected: Miasma Supply Chain Attack Is Back on npm — OX Security","type":"research","credibility":2}],"severity":"critical"},{"content":"Exfiltration was routed through GitHub itself as dead-drop infrastructure, blending with normal GitHub API traffic. The attacker-controlled account 'liuende501' hosted 236 programmatically created repositories at the time of disclosure. Sources differ on the encryption used: the credential bundles are described as AES-encrypted in StepSecurity/Snyk/OX Security-based reporting, and as encrypted with RSA public keys readable only by the attacker in StepSecurity/JFrog-based reporting. Repository naming followed mythologically themed patterns: 34 repositories were labeled 'Miasma - The Spreading Blight' and 195 bore the reversed string 'niagA oG eW ereH :duluH-iahS' ('Shai-Hulud: Here We Go Again'), a taunt referencing the prior Red Hat Cloud Services compromise. Credential packages were stored as encrypted JSON files at paths of the form results/results-[timestamp].json in repositories named in an adjective-creature format (e.g., 'nemean-hydra-34343'). The payload used a 'python-requests/2.31.0' User-Agent despite running inside Bun, likely as misdirection, and JFrog reported exfiltration calls camouflaged to resemble 'api.anthropic.com/v1/api' traffic. C2 keywords identified in the payload include 'thebeautifulmarchoftime' (used to confirm active control) and 'IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner'.","heading":"Exfiltration and C2 Infrastructure","sources":[{"url":"https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm","name":"Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp — StepSecurity","type":"research","credibility":2},{"url":"https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/","name":"Node-gyp Supply Chain Compromise — Snyk","type":"research","credibility":2},{"url":"https://www.ox.security/blog/600000-monthly-downloads-affected-miasma-supply-chain-attack-is-back-on-npm/","name":"600,000 Monthly Downloads Affected: Miasma Supply Chain Attack Is Back on npm — OX Security","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/","name":"Shai-Hulud — Miasma: The Spreading Blight Hits Red Hat npm Packages — JFrog Security Research","type":"research","credibility":2}],"severity":"high"},{"content":"The June 3 Phantom Gyp wave compromised 57 npm packages across 286+ malicious versions (ReversingLabs' analysis is titled around 56 packages). The highest-traffic victims were @vapi-ai/server-sdk (approximately 86,500 weekly downloads; 408,000+ monthly), compromised in versions 0.11.1, 0.11.2, 1.2.1 and 1.2.2; and ai-sdk-ollama (approximately 36,900 weekly downloads; 120,000+ monthly), compromised in versions 0.13.1, 1.1.1, 2.2.1 and 3.8.5. The remaining packages, predominantly traced to the maintainer account 'jagreehal', included the autotel-* family of database adapters and framework integrations (approximately 25 packages per one account, 24 per another), 8 packages in the awaitly-* family (including eslint-plugin-awaitly), 8 packages in the eslint-plugin-executable-stories / executable-stories family, 5 packages in the node-env-resolver family, wrangler-deploy variants, and packages under the @jagreehal/* scope. According to Vapi's official incident post, the four @vapi-ai/server-sdk versions were removed within approximately two hours and fifty minutes of publication and recorded zero downloads during the exposure window. Consumers should audit install logs for the listed version strings and rotate all credentials present in affected environments.","heading":"Affected Packages and Download Exposure","sources":[{"url":"https://vapi.ai/blog/our-response-to-june-3-supply-chain-incident","name":"Our response to the June 3, 2026 supply chain incident — Vapi.ai","type":"official","credibility":1},{"url":"https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/","name":"Node-gyp Supply Chain Compromise — Snyk","type":"research","credibility":2},{"url":"https://www.chainguard.dev/unchained/chainguard-artifacts-safe-from-miasma-phantom-gyp-npm-attack","name":"Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions — Chainguard","type":"research","credibility":2},{"url":"https://corgea.com/research/miasma-phantom-gyp-npm-worm-vapi-ai-sdk-ollama-june-2026","name":"Phantom Gyp Miasma hit Vapi, ai-sdk-ollama, and 55 more npm packages — Corgea","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm","name":"Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp — StepSecurity","type":"research","credibility":2},{"url":"https://www.reversinglabs.com/blog/npm-bindinggyp-cicd-secrets","name":"How 56 npm packages used binding.gyp to steal CI/CD secrets — ReversingLabs","type":"research","credibility":2}],"severity":"high"},{"content":"Vapi.ai published an official incident response confirming that an unexpired access token from a developer's personal GitHub account was the initial access vector. During a 34-minute window between 22:56 and 23:30 UTC on June 3, 2026, the compromised account pushed malicious changes to Vapi repositories; its elevated access allowed it to disable branch protections, enabling direct pushes that would ordinarily be blocked. The four npm versions were published at approximately 23:30 UTC. Vapi removed the malicious versions and rolled back changes by approximately 7:20 PM PT (02:20 UTC June 4), and confirmed zero downloads of the affected versions. Vapi learned on June 4 of StepSecurity's public disclosure linking the incident to the wider campaign. Stated remediation included removal of the malicious npm versions; revocation of the compromised account's access; deletion of compromised branches; an audit of all GitHub users, access patterns and OAuth applications; strengthened branch protections on SDK default branches; and precautionary rotation of internal secrets and keys. Vapi stated that no customer data, customer credentials or production platform systems were breached.","heading":"Vapi.ai Incident Response","sources":[{"url":"https://vapi.ai/blog/our-response-to-june-3-supply-chain-incident","name":"Our response to the June 3, 2026 supply chain incident — Vapi.ai","type":"official","credibility":1},{"url":"https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm","name":"Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp — StepSecurity","type":"research","credibility":2}],"severity":"medium"},{"content":"Wave 2 malicious versions were delisted from the npm registry following disclosure. npm subsequently announced a v12 security overhaul that blocks install scripts, including node-gyp invocations triggered by binding.gyp, by default, with a July 2026 deadline for CI environment migration. Chainguard reported that customers using Chainguard Images, which build from source rather than consuming registry tarballs, were not affected, as the technique has no execution surface in source-build pipelines. StepSecurity's Harden-Runner was cited as capable of detecting the attack via behavioral monitoring of child processes spawned during npm install. No CVE had been formally assigned to the campaign as of the investigation date; applicable CWEs cited include CWE-506 (Embedded Malicious Code), CWE-494 (Download Without Integrity Check), CWE-522 and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere).","heading":"Industry Response and Mitigations","sources":[{"url":"https://www.chainguard.dev/unchained/chainguard-artifacts-safe-from-miasma-phantom-gyp-npm-attack","name":"Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions hijack CI/CD pipelines — Chainguard","type":"research","credibility":2},{"url":"https://www.techtimes.com/articles/318328/20260613/npm-v12-security-overhaul-blocks-install-scripts-default-july-deadline-ci-migration.htm","name":"npm v12 Security Overhaul Blocks Install Scripts by Default — TechTimes","type":"news_article","credibility":2},{"url":"https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages","name":"Miasma: Supply Chain Attack Targeting RedHat npm Packages — Wiz Blog","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm","name":"Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp — StepSecurity","type":"research","credibility":2},{"url":"https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/","name":"Node-gyp Supply Chain Compromise — Snyk","type":"research","credibility":2}],"severity":"medium"},{"content":"Researchers trace the Shai-Hulud/Miasma lineage to September 2025. On June 5, 2026, two days after Phantom Gyp, a further Miasma propagation wave compromised 73 Microsoft GitHub repositories across the Azure, Azure-Samples, Microsoft and MicrosoftDocs organizations using previously stolen contributor credentials; GitHub disabled the affected repositories in a 105-second automated sweep, though disabling azure/functions-action disrupted CI/CD pipelines for organizations relying on that official GitHub Action. On June 6, 2026, JFrog identified a 'Hades' evolution of the campaign that added targeting of JFrog Artifactory credentials, extended propagation to PyPI (.pth loader injection) and RubyGems (extconf.rb injection), and introduced AI assistant prompt injection. A concurrent but separate campaign dubbed IronWorm also targeted npm packages via the compromised account 'asteroiddao', deploying a Rust ELF information stealer with an eBPF kernel rootkit capable of targeting 86 environment variables, including cryptocurrency wallet credentials.","heading":"Broader Miasma/Shai-Hulud Campaign Context","sources":[{"url":"https://thehackernews.com/2026/06/miasma-worm-hits-73-microsoft-github.html","name":"Miasma Worm Hits 73 Microsoft GitHub Repositories — The Hacker News","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/06/ironworm-and-new-miasma-worm-variant.html","name":"IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks — The Hacker News","type":"news_article","credibility":2},{"url":"https://socprime.com/active-threats/shai-hulud-here-we-go-again-worm-by-teampcp-hits-npm-and-pypi/","name":"Shai-Hulud Worm Hits NPM and PyPI Supply Chains — SOC Prime","type":"research","credibility":2},{"url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/","name":"Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks — SecurityWeek","type":"news_article","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/","name":"Shai-Hulud — Miasma: The Spreading Blight Hits Red Hat npm Packages — JFrog Security Research","type":"research","credibility":2}],"severity":"high"},{"content":"Attribution for the June 3 wave remains uncertain; no formal attribution to a known threat actor group had been published as of the investigation date. The campaign is technically linked to the Miasma/Shai-Hulud worm family, and the 'Shai-Hulud' taunt strings suggest continuity with prior waves. TeamPCP is the group associated with developing the original Shai-Hulud toolkit and with a May 2026 PyPI attack; however, its May 12, 2026 open-sourcing of the Mini Shai-Hulud codebase on GitHub and BreachForums means independent actors could have deployed the June 3 wave without any direct connection to TeamPCP. The Hacker News and SecurityWeek both characterized attribution as indeterminate given the open-source nature of the toolkit. The exfiltration infrastructure (GitHub account liuende501, 236 staging repositories) was assessed as attacker-controlled based on its programmatic structure and taunt strings, but no identity has been publicly confirmed. The use of forged Sigstore SLSA provenance attestations reflects a sophisticated understanding of modern supply chain integrity tooling.","heading":"Attribution and Threat Actor Assessment","sources":[{"url":"https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/","name":"Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks — SecurityWeek","type":"news_article","credibility":2},{"url":"https://blog.securityjoes.com/post/shai-hulud-miasma-when-a-supply-chain-worm-learned-to-hijack-ai-coding-agents","name":"Shai-Hulud: Miasma — When a Supply-Chain Worm Learned to Hijack AI Coding Agents — Security Joes","type":"research","credibility":2},{"url":"https://socprime.com/active-threats/shai-hulud-here-we-go-again-worm-by-teampcp-hits-npm-and-pypi/","name":"Shai-Hulud Worm Hits NPM and PyPI Supply Chains — SOC Prime","type":"research","credibility":2},{"url":"https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm","name":"Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp — StepSecurity","type":"research","credibility":2},{"url":"https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/","name":"Shai-Hulud — Miasma: The Spreading Blight Hits Red Hat npm Packages — JFrog Security Research","type":"research","credibility":2}],"severity":"medium"},{"content":"The campaign poses an elevated risk to cryptocurrency and blockchain development workflows. Packages such as @vapi-ai/server-sdk and ai-sdk-ollama are used in AI-agent and voice-AI stacks that can interface with blockchain services and crypto payment infrastructure. CI/CD pipelines that manage smart contract deployments, wallet signers or validator keys commonly hold AWS/GCP/Azure secrets (used to reach key management services), Kubernetes service account tokens (used to reach secret stores), GitHub Actions tokens (used to trigger deployments) and .env files containing RPC endpoints, hot-wallet private keys or test seed phrases; the payload's sweep of .env files across the project tree is particularly relevant to developers who store wallet keys or mnemonics in environment variables. The concurrent IronWorm campaign explicitly targeted cryptocurrency wallet credentials. The AI coding assistant poisoning vectors specifically target developers using AI-assisted tooling, a growing workflow in web3 development. Because the worm self-propagates, a single compromised maintainer account in a dependency tree could silently poison transitive dependencies. Any developer who ran 'npm install' on an affected package version, in CI/CD or locally, should treat all credentials present in that environment as compromised, regardless of whether the malware was observed executing.","heading":"Relevance to Crypto and Web3 Developers","sources":[{"url":"https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/","name":"Node-gyp Supply Chain Compromise — Snyk","type":"research","credibility":2},{"url":"https://thehackernews.com/2026/06/ironworm-and-new-miasma-worm-variant.html","name":"IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks — The Hacker News","type":"news_article","credibility":2},{"url":"https://www.chainguard.dev/unchained/chainguard-artifacts-safe-from-miasma-phantom-gyp-npm-attack","name":"Miasma Phantom Gyp npm attack: 57 packages, 286 malicious versions — Chainguard","type":"research","credibility":2},{"url":"https://cybersecuritynews.com/binding-gyp-supply-chain-attack-compromises-dozens-of-npm-packages/","name":"binding.gyp Supply Chain Attack Compromises Dozens of npm Packages Across Maintainer Accounts — CybersecurityNews","type":"news_article","credibility":2},{"url":"https://corgea.com/research/miasma-phantom-gyp-npm-worm-vapi-ai-sdk-ollama-june-2026","name":"Phantom Gyp Miasma hit Vapi, ai-sdk-ollama, and 55 more npm packages — Corgea","type":"research","credibility":2}],"severity":"high"},{"content":"File indicators: a binding.gyp containing the '