Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp
A novel npm worm abuses node-gyp's binding.gyp compilation step to execute code without lifecycle scripts—evading the standard mitigations that registries and lockdown tools rely on, while also persisting through GitHub token theft.
Summary written by editorial AI · Source link below
A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-propagates across maintainers.
Editorial Analysis
By hiding in native build configuration files rather than lifecycle scripts, this technique bypasses the very controls npm introduced after previous supply-chain incidents, demanding new detection strategies.
Audit binding.gyp files in native npm dependencies for unexpected shell commands, and enforce GitHub token scoping with short-lived credentials in CI/CD.
A new npm worm bypasses established supply-chain defences by hiding in native build files, requiring updated security controls across developer toolchains.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at Snyk Blog in a new tab.
More from the DevSecOps Desk
- Nearly 1.5 million exposed secrets targeted in new revocation program4d
- From Lab to Reality: A Practical Evaluation of Deep Learning Models and LLMs for Vulnerability Detection4d
- A.S.E 2.0: Understanding How Repository Context Impacts the Security of LLM-Generated Code4d
- A Hybrid Approach for Automated Security Pattern Recovery4d
- Chainguard endpoints now handle breaking changes5d