Tracked campaign · npm

Miasma worm

npm worm that abuses binding.gyp action targets to execute credential-stealing shell commands during node-gyp compilation, bypassing lifecycle-script inspection.

209 packages attributednpm ecosystemosv source

First seen 2025-06-02

Attribution basis

These are the signal classes linking the members of this campaign — the broad evidence categories we use to attribute a package, not the raw indicators themselves.

shared malware fingerprint
OSV advisory cluster

PkgRadar attributes coordinated supply-chain campaigns and blocks their packages at the CI gate. Start free or see all tracked campaigns.