Miasma Phantom Gyp: binding.gyp triggers node index.js during npm install

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects execution of node-gyp to compile native Node.js addons, which can be leveraged by attackers to execute arbitrary code or build malicious modules during project installation or development. The rule looks for binding.gyp usage and build commands initiated by npm or node processes.