Miasma Phantom Gyp: node-gyp Spawning node index.js at npm Install Time
Detects a specific execution pattern where node-gyp.exe spawns node.exe to execute an 'index.js' file. This behavior is associated with the 'Miasma' or 'Mini Shai-Hulud' threat campaigns, which utilize malicious 'binding.gyp' files within npm packages to bypass standard lifecycle script (preinstall/postinstall) security scanners.
YARA-L
