Miasma Phantom Gyp: node-gyp Spawning node index.js During npm Install

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects anomalous process execution patterns associated with supply chain compromises (specifically Miasma/Mini Shai-Hulud 'Phantom Gyp'), where node-gyp build processes or npm lifecycle scripts trigger the execution of unexpected scripts or unauthorized runtimes like Bun.