Malicious npm Package binding.gyp Command Expansion Executing index.js

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects node-gyp rebuilding a native addon where the binding.gyp file utilizes GYP command expansion to execute index.js. Malicious npm packages often abuse this mechanism to execute arbitrary JavaScript code during the build process, bypassing standard lifecycle script scanners.