Phantom Gyp npm Supply Chain Attack (June 2026)
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·32G228…mpTjSummary
On June 3, 2026, attackers published 286 malicious versions across 57 npm packages in under two hours, using a technique researchers named 'Phantom Gyp' that abused binding.gyp native-build configuration files to execute code during npm install without any entry in package.json lifecycle scripts, evading tooling that audits those scripts. The campaign, tracked as 'Miasma' and described as the eighth wave of the Shai-Hulud worm lineage, harvested CI/CD and developer credentials (npm, GitHub, AWS, GCP, Azure, HashiCorp Vault, Kubernetes, password managers), self-propagated using stolen publishing tokens with forged SLSA provenance, and planted backdoors in AI coding assistant configuration files. It followed a June 1 Miasma wave against 32 @redhat-cloud-services packages; the highest-profile Phantom Gyp victim, @vapi-ai/server-sdk (408,000+ monthly downloads), had its four malicious versions removed with zero recorded downloads according to Vapi.
Connected Entities
4 entities · 45 linked investigations- node-gyp npm Supply Chain Compromise (June 2026)→mentioned with→Phantom Wallet(70%)
- node-gyp npm Supply Chain Compromise (June 2026)→mentioned with→Shai-Hulud / TeamPCP Supply Chain Attack(70%)
- Phantom Gyp npm Supply Chain Attack (June 2026)→mentioned with→Shai-Hulud / TeamPCP Supply Chain Attack(70%)
- Phantom Gyp npm Supply Chain Attack (June 2026)→mentioned with→Phantom Wallet(70%)
Connected Through
2 shared actors · 45 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Phantom Walletorganization
- □Shai-Hulud / TeamPCP Supply Chain Attackorganization
Timeline(16 events)
September 2025
First Shai-Hulud self-replicating npm worm observed; associated with threat actor group TeamPCP.
SOC PrimeMay 2026
TeamPCP publishes the full Mini Shai-Hulud worm source code to GitHub alongside BreachForums posts encouraging independent campaigns.
SecurityWeekJune 2026
Miasma worm compromises 32 packages across 96 malicious versions in the @redhat-cloud-services npm namespace within 72 seconds; combined weekly downloads approximately 116,991.
The Hacker NewsJune 2026
Wiz Research identifies the Red Hat wave, carried out through a compromised Red Hat employee GitHub account; most malicious versions revoked by 14:00 UTC.
Wiz Blog / JFrog Security ResearchJune 2026
At approximately 22:56 UTC, a compromised developer's personal GitHub access token is used to begin pushing malicious changes to Vapi.ai repositories, disabling branch protections.
Vapi.ai official incident responseJune 2026
At approximately 23:30 UTC, four malicious versions of @vapi-ai/server-sdk (0.11.1, 0.11.2, 1.2.1, 1.2.2) are published to npm; the Phantom Gyp wave begins.
Vapi.ai official incident responseJune 2026
Within one hour of the initial breach, attackers pivot to the jagreehal maintainer account and publish poisoned versions of 55+ additional packages across the autotel, awaitly, ai-sdk-ollama and related families.
SnykJune 2026
The 57-package, 286-malicious-version campaign completes in under two hours; the 157-byte binding.gyp abuses GYP command substitution to execute the payload.
StepSecurityJune 2026
At approximately 19:20 PT (02:20 UTC June 4), Vapi removes the four malicious @vapi-ai/server-sdk versions and rolls back repository changes; zero downloads confirmed.
Vapi.ai official incident responseJune 2026
StepSecurity publishes its initial disclosure naming the technique 'Phantom Gyp' and the campaign 'Miasma'; JFrog ties it to the Shai-Hulud lineage; malicious Wave 2 versions begin to be delisted. A second Red Hat sub-wave is discovered the same day.
StepSecurity / JFrog Security ResearchJune 2026
Vapi learns of StepSecurity's public disclosure connecting the @vapi-ai incident to the wider campaign.
Vapi.ai official incident responseJune 2026
Snyk, StepSecurity, Corgea, ReversingLabs, Chainguard, Wiz and The Hacker News publish detailed technical analyses of the Phantom Gyp technique and four-stage payload.
The Hacker NewsJune 2026
Cybersecurity Dive reports on the Red Hat connection; Red Hat confirms no official products were impacted.
Cybersecurity DiveJune 2026
Miasma propagates to 73 Microsoft GitHub repositories across Azure, Azure-Samples, Microsoft and MicrosoftDocs using previously stolen contributor credentials; GitHub disables them in a 105-second automated sweep.
The Hacker NewsJune 2026
JFrog identifies a 'Hades' variant extending propagation to PyPI (.pth loader injection), RubyGems (extconf.rb injection) and JFrog Artifactory, and introducing AI assistant prompt injection via jailbreak prompts in Cursor, Copilot and Claude rule files.
JFrog Security ResearchJune 2026
npm announces a v12 security overhaul that blocks install scripts (including binding.gyp-triggered node-gyp invocations) by default, with a July 2026 CI migration deadline.
TechTimesDecision Log
- slot 427384392 · hash AeH6MFcdZCwYWbAgijXQYWKkm78YoLAuozoF9bhEfZ4s
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 22 of 22 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 6/18/2026, 11:05:29 PM
last updated: 10/2/2026, 5:25:28 AM
4 viewsavoid.net — verified advice for a post-truth world