Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp
The "Miasma" npm supply chain attack exploits native build processes using a weaponized binding.gyp file to execute self-propagating malware and steal CI/CD credentials. This worm automates the infection of dozens of packages by bypassing security scanners, targeting cloud secrets, and forging provenance Ref: https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm
Microsoft Sentinel (KQL)
