# Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp

DevFeed: [Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp](<https://devfeed.tech/articles/node-gyp-supply-chain-compromise-a-self-propagating-npm-worm-that-hides-in-binding-gyp-8034.md>)

Original publisher: [Read original article](<https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/>)

Author: Liran Tal

Published: 2026-06-04T04:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Security](<https://devfeed.tech/topics/security.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>)

Tags: [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [devsecops](<https://devfeed.tech/tags/devsecops.md>), [eslint](<https://devfeed.tech/tags/eslint.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [malware](<https://devfeed.tech/tags/malware.md>), [node](<https://devfeed.tech/tags/node.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [payload](<https://devfeed.tech/tags/payload.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [scm](<https://devfeed.tech/tags/scm.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [tech](<https://devfeed.tech/tags/tech.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>)

## AI overview

Snyk reports a critical npm supply-chain compromise in which a weaponized binding.gyp file abuses node-gyp during installation to execute malicious code without relying on lifecycle scripts. The worm affects 57 packages, harvests developer and CI/CD credentials, exfiltrates them through GitHub repositories, injects GitHub Actions workflows for persistence, and republishes packages accessible through compromised maintainer accounts.

## Source excerpt

A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-propagates across maintainers.