binding.gyp Supply Chain Attack Enables npm CI/CD Worm Propagation
binding.gyp Supply Chain Attack Enables npm CI/CD Worm Propagation is a high-severity supply chain compromise issue in binding.gyp Supply Chain Attack Enables npm CI/CD Worm Propa, a CI integration. Affected: 57+ npm packages / 286+ malicious versions with phantom binding.gyp (Miasma wave 2, June 3-4 2026). It has been exploited in the wild.
Is binding.gyp Supply Chain Attack Enables npm CI/CD Worm Propa running on your developers' machines? Anomity inventories the AI agents, MCP servers, extensions and skills on every developer device, so you can see what this advisory touches. Detect this across your developers' devices with Anomity →
Key facts
- ID
binding-gyp-supply-chain-attack-enables-npm-ci-cd-worm-propagation- Severity
- high
- Attack type
- Supply chain compromise, Malware
- Component
- binding.gyp Supply Chain Attack Enables npm CI/CD Worm Propa · CI integration
- Known exploited
- Yes
- Published
- Last verified
What is this vulnerability?
Researchers identified an active npm supply-chain attack that abuses the binding.gyp build mechanism to execute malicious code during install via node-gyp, bypassing many controls that only watch preinstall/postinstall scripts. The worm propagates across packages through CI/CD. Linked to TeamPCP.
Affected versions
| Affected | Fixed in |
|---|---|
57+ npm packages / 286+ malicious versions with phantom binding.gyp (Miasma wave 2, June 3-4 2026) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run 57+ npm packages / 286+ malicious versions with phantom binding.gyp (Miasma wave 2, June 3-4 2026).
How do I fix it?
Audit dependencies for unexpected binding.gyp / node-gyp build steps; disable native build scripts for untrusted packages (e.g. npm --ignore-scripts in CI) and review CI runners for worm propagation since early June.