Miasma Phantom Gyp - Suspicious Process Chain During npm Install

Leonardo Gasparini@Leonardo.Gasparini

•updated Jun 4, 2026•0•0•11

Detects the Miasma worm kill chain triggered via binding.gyp during npm install. The attack spawns node-gyp which executes a malicious index.js, downloads Bun runtime via curl, and launches the payload with bun. A legitimate npm install should not spawn curl/unzip or download alternative JavaScript runtimes.