Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp" Trick and Bun Runtime to Steal Developer Credentials Across npm, Go, and RubyGems
Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp" (TL-2026-1242), also tracked as Phantom Gyp, is a high-severity supply-chain compromise, first published 2026-06-26. It is attributed to Mini Shai-Hulud with low confidence, affects LeoPlatform/RStreams leo-auth, maps to 41 MITRE ATT&CK techniques (T1005, T1027, T1027.002), and is covered by 9 detection rules and 31 indicators of compromise.
Key facts for TL-2026-1242
- Threat ID
- TL-2026-1242
- Also known as
- Phantom Gyp, Miasma npm worm
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-26
- Last reviewed
- 2026-06-26
- Attribution
- Mini Shai-Hulud
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cloud-services, open-source, devops, blockchain
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp"
Malware and tooling: Hades, Miasma, Mini Shai-Hulud
The Miasma campaign (part of the Mini Shai-Hulud / Hades malware cluster) compromised 20+ npm packages in the LeoPlatform/RStreams ecosystem plus other npm packages, a Go module (Verana Blockchain), and RubyGems targets, using a "Phantom Gyp" technique that abuses binding.gyp/node-gyp command substitution to trigger obfuscated JavaScript without visible install scripts. A Bun-staged, AES-GCM/Caesar-cipher-obfuscated payload harvests npm/PyPI/GitHub/cloud/CI/SSH/AI-assistant credentials and self-propagates by forging Sigstore SLSA provenance on republished packages.
How Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp" works
Miasma is an active, self-propagating supply-chain malware campaign first observed publishing over 20 malicious npm package versions within a tight window on June 24, 2026, targeting the LeoPlatform and RStreams data-pipeline ecosystem (leo-sdk, leo-auth, leo-aws, leo-cli, leo-logger, and 14 related packages) as well as unrelated packages published under the npm account "llxlr" (hexo-deployer-wrangler, hexo-shoka-swiper, prism-silq, solo-nav). Socket.dev researchers attribute the cluster to the same lineage as Mini Shai-Hulud and Hades, tracking 471+ affected artifacts across npm and PyPI at the time of reporting.
The core technique, dubbed "Phantom Gyp" by StepSecurity, abuses the fact that npm automatically invokes node-gyp when a package contains a binding.gyp file, even for packages that have no legitimate native-addon requirement. The malicious binding.gyp uses gyp's command-substitution syntax — e.g. `"sources": ["<!(node index.js > /dev/null 2>&1 && echo stub.c)"]` — to execute an oversized (4+MB), heavily obfuscated root-level index.js during `npm install`, entirely bypassing the preinstall/postinstall hooks that most supply-chain security tooling monitors. The legitimate package logic is left untouched in dist/; the malicious index.js is never imported by any application code and exists purely to be triggered by node-gyp.
The payload uses a multi-layer obfuscation chain: a Caesar-cipher-shifted first-stage loader evaluated via eval(), which decrypts AES-GCM-encrypted embedded stages, which in turn detect or silently install the Bun JavaScript runtime (downloading Bun v1.3.13 from github.com/oven-sh/bun/releases if absent) and execute the final stage via `bun run` outside the Node.js process tree — evading security tools and EDR hooks that instrument Node.js but not Bun execution.
Once running, Miasma harvests an extremely broad set of developer and CI/CD secrets: npm, PyPI, and RubyGems tokens; GitHub, Slack, and Twilio credentials; SSH keys; Docker auth files; Kubernetes service-account material; AWS/Azure/GCP credentials; HashiCorp Vault data; shell history and .env files; and configuration for AI coding assistants (Claude, Cursor, Gemini, GitHub Copilot). Stolen data is RSA-wrapped, packaged as encrypted JSON, and exfiltrated to attacker-controlled GitHub repositories under the account liuende501 (236+ programmatically created repos), written via the GitHub Contents API to paths like `repos/liuende501/{repo}/contents/results/results-{timestamp}.json`. The malware also uses GitHub commit-search as a dead-drop/beacon channel, searching for operator tokens such as "thebeautifulmarchoftime" (status check) and "IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner" (token validation), alongside the shared campaign marker "RevokeAndItGoesKaboom" that links the npm and GitHub Actions attack clusters.
Miasma self-propagates worm-style: using stolen npm tokens it calls the registry.npmjs.org/-/whoami endpoint to validate credentials, enumerates the compromised maintainer's other packages, downloads them, injects fresh binding.gyp/index.js payloads, forges SLSA provenance attestations via Sigstore so the republished packages appear legitimately built through CI, and republishes — reinfecting 57 packages across 286+ malicious versions in under two hours during observed bursts. An equivalent technique targets RubyGems by injecting the payload into extconf.rb, Ruby's native-extension build mechanism, with a matching Bun downloader.
The campaign also poisons GitHub repositories directly: attackers push orphan `snapshot-*` branches containing fake Dependabot-like dependency-update workflows and a "Run Copilot" GitHub Actions workflow template that appears to invoke GitHub Copilot but instead exfiltrates Actions secrets by uploading them as workflow artifacts. These workflows request elevated Actions publishing permissions and exploit mutable-tag GitHub Actions checkouts and pull_request_target workflows that check out untrusted PR head SHAs.
A parallel, source-repository-poisoning variant was found in the Go module github.com/verana-labs/verana-blockchain@v0.10.1-dev.20, which does not require binding.gyp at all: it drops `.claude/index.js` (an obfuscated loader), `.claude/setup.mjs` and `.vscode/setup.mjs` (Bun launcher scripts), and a `.vscode/tasks.json` configured to run `node .claude/setup.mjs` automatically whenever a developer opens the folder in VS Code — plus a non-functional Claude Code SessionStart hook referencing a missing `.github/setup.js`, suggesting the actors are also probing AI-coding-agent execution surfaces as an infection vector.
MITRE ATT&CK techniques used in TL-2026-1242
Collection
T1005 Data from Local System; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1036 Masquerading; T1070 Indicator Removal; T1127 Trusted Developer Utilities Proxy Execution; T1140 Deobfuscate/Decode Files or Information
Execution
T1053 Scheduled Task/Job; T1059.007 JavaScript; T1204 User Execution; T1610 Deploy Container
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Lateral Movement
T1072 Software Deployment Tools
Privilege Escalation
T1078 Valid Accounts; T1078.004 Cloud Accounts
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery; T1518.001 Security Software Discovery
Initial Access
T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Persistence
T1505 Server Software Component; T1525 Implant Internal Image; T1546 Event Triggered Execution
Credential Access
T1552 Unsecured Credentials; T1552.001 Credentials In Files; T1552.004 Private Keys; T1552.005 Cloud Instance Metadata API; T1555 Credentials from Password Stores
Impact
Exfiltration
T1567 Exfiltration Over Web Service; T1567.002 Exfiltration to Cloud Storage
Resource Development
T1585 Establish Accounts; T1586 Compromise Accounts
defense-impairment
Affected products and versions in Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp"
- LeoPlatform/RStreams — leo-auth
Vulnerable versions: 4.0.6
Fixed in: revert to last known-clean version prior to 2026-06-24 - LeoPlatform/RStreams — leo-aws
Vulnerable versions: 2.0.4
Fixed in: pre-2026-06-24 release - LeoPlatform/RStreams — leo-cache
Vulnerable versions: 1.0.2
Fixed in: pre-2026-06-24 release - LeoPlatform/RStreams — leo-cdk-lib
Vulnerable versions: 0.0.2
Fixed in: pre-2026-06-24 release - LeoPlatform/RStreams — leo-cli
Vulnerable versions: 3.0.3
Fixed in: pre-2026-06-24 release - LeoPlatform/RStreams — leo-config
Vulnerable versions: 1.1.1
Fixed in: pre-2026-06-24 release - LeoPlatform/RStreams — leo-connector-elasticsearch
Vulnerable versions: 2.0.6
Fixed in: pre-2026-06-24 release - LeoPlatform/RStreams — leo-connector-mongo
Vulnerable versions: 3.0.8
Fixed in: pre-2026-06-24 release - LeoPlatform/RStreams — leo-connector-mysql
Vulnerable versions: 3.0.3
Fixed in: pre-2026-06-24 release - LeoPlatform/RStreams — leo-connector-oracle
Vulnerable versions: 2.0.1
Fixed in: pre-2026-06-24 release
Remediation for Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp"
Patches
- No vendor patch applicable — remediation is removal of malicious package versions (see affected_json for clean/vulnerable version boundaries) and dependency rebuild
Immediate actions
- Identify all machines and CI/CD runners that installed any affected npm package version, Go module version, or RubyGems package and treat them as compromised
- Preserve forensic evidence (process trees, network logs, disk artifacts) before remediation
- Remove/downgrade all affected package versions and rebuild dependency trees from clean, pinned lockfiles
- Rotate ALL credentials that may have been present on affected machines: npm, PyPI, RubyGems, GitHub, AWS, Azure, GCP, Vault, SSH keys, Docker registry auth, Kubernetes service-account tokens, Slack, Twilio, and AI-assistant (Claude, Cursor, Gemini, Copilot) tokens/configs — perform rotation from a known-clean machine
- Audit repositories for injected artifacts: unexpected binding.gyp in pure-JS packages, oversized (4+MB) undeclared root index.js files, .claude/setup.mjs, .cursor/rules/setup.mdc, .vscode/tasks.json with folder-open execution, orphan snapshot-* branches, fake Dependabot-style workflows, and 'Run Copilot' GitHub Actions templates
- Block outbound network access to github.com/liuende501 and audit for unexpected Bun runtime downloads from github.com/oven-sh/bun/releases
Workarounds
- Run `npm install --ignore-scripts` to prevent postinstall AND gyp/node-gyp-triggered execution during dependency installs
- Use dependency lockfile integrity hashes (package-lock.json integrity, npm ci) to prevent silent version substitution
- Flag/quarantine packages that declare a binding.gyp but have no legitimate native-addon requirement, or that ship oversized root-level JS files not referenced by package.json main/exports
Longer-term hardening
- Deploy registry cooldown/quarantine policies that hold newly published package versions before they are served to installs
- Implement runtime monitoring for unauthorized process chains spawned by node-gyp (e.g., curl/unzip/bun child processes) and for Bun execution outside expected contexts
- Maintain a continuously updated compromised-package-version database and gate CI/CD installs against it
- Pin all GitHub Actions to immutable full-length commit SHAs rather than mutable tags; monitor for tag drift
- Restrict npm trusted publishing / GitHub OIDC scopes to only the workflows and branches that require them
- Review and harden pull_request_target workflows to never check out untrusted PR head code
Weaknesses (CWE) in Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp"
CWE-506, CWE-829, CWE-494, CWE-1357, CWE-798
Timeline of Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp"
- Original Shai-Hulud worm compromises npm ecosystem, establishing the credential-theft/self-propagation pattern later reused by Miasma (Unit42).
- Unit42 publishes ongoing npm threat-landscape tracking covering the broader Shai-Hulud-derived attack surface.
- Mini Shai-Hulud wave compromises 317 additional npm packages, per SafeDep tracking, showing the cluster's continued activity ahead of the Miasma burst.
- Dark Reading reports the 'Hades' variant of the campaign attacking PyPI packages, confirming cross-registry targeting.
- Socket.dev reports Mini Shai-Hulud, Miasma, and Hades worms targeting bioinformatics and MCP developer packages via malicious dependencies.
- A parallel source-repository-poisoning variant is discovered in the Go module github.com/verana-labs/verana-blockchain@v0.10.1-dev.20, using .claude/.vscode launcher scripts instead of binding.gyp.
- Attackers publish 20+ malicious versions of LeoPlatform/RStreams npm packages plus additional packages under the 'llxlr' account within a tight time window, using the Phantom Gyp binding.gyp technique.
- GBHackers reports on the Mini Shai-Hulud worm poisoning LeoPlatform npm packages to steal developer and CI/CD secrets.
- Socket.dev publishes detailed technical analysis ('Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and Go Ecosystem'), attributing the cluster and detailing the binding.gyp/node-gyp/Bun execution chain.
- StepSecurity publishes the 'Phantom Gyp' deep-dive, revealing the exact gyp command-substitution payload, the Sigstore provenance-forgery self-propagation mechanism, and the RubyGems extconf.rb equivalent vector.
- Cyber Security News, The Hacker News, Phoenix Security, and Corgea publish coordinated coverage of the Miasma campaign, including SHA-256 IOCs and MITRE mapping.
- NHS England Digital issues a cyber alert (CC-4781) covering the supply-chain attack affecting numerous npm and PyPI packages.
- TL-Intel-Harness ingests the campaign via the Cyber Security News feed article and opens threat TL-2026-1242 for research.
Sources cited for Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp"
- Miasma Malware Uses binding.gyp and Bun to Bypass Security Detections
- Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
- Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp
- Miasma/Hades Variant Hits LeoPlatform: npm Worm Runs binding.gyp Under Bun to Steal Cloud Credentials
- Leo Platform npm packages compromised with Phantom Gyp Miasma toolkit
- Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and Go Ecosystem
- Miasma Worm Infects Multiple LeoPlatform npm Packages
- Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers
- Mini Shai-Hulud Worm Poisons LeoPlatform npm Packages to Steal Developer and CI/CD Secrets
- Supply Chain Attack Affecting Numerous npm and PyPI Packages
- 'Hades' Attacks on PyPI Put New Spin on Shai-Hulud
- Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised
- The npm Threat Landscape: Attack Surface and Mitigations
- Shai-Hulud Worm Compromises npm Ecosystem in Supply Chain Attack
Threats related to Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp"
- Miasma Malware Supply Chain Attack Targets npm Packages, Go Module, and GitHub Actions CI/CD Pipelines
- Binding.gyp "Phantom Gyp" Supply Chain Attack (Miasma Worm) Enables CI/CD Worm Propagation Across 57 npm Packages
- npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma Botnet via IPFS-Hosted Second-Stage Payload
- Keyv and Cacheable npm Supply Chain Attack via Compromised Maintainer Account (Shai-Hulud Malware)
- Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub (Shai-Hulud / Mini Shai-Hulud Variant)
- Mini Shai-Hulud Resurfaces — intercom-client@7.0.4 npm Worm Harvesting GitHub & Cloud Credentials (TeamPCP)
Detection coverage for TL-2026-1242
As of 2026-06-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1242 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.