Phantom Gyp Miasma worm hits @vapi-ai/server-sdk and the jagreehal portfolio via binding.gyp

What happened

On 2026-06-03 at 23:30 UTC the Miasma operator (the same TeamPCP / Mini Shai-Hulud lineage behind the 2026-06-01 @redhat-cloud-services wave two days earlier) published four malicious versions of @vapi-ai/server-sdk, the official Vapi.ai voice-AI server SDK with ~408,000 weekly downloads. Within an hour the worm pivoted to the unrelated jagreehal maintainer account and used the stolen publish token to enumerate every package that account owned, republishing a tampered X.Y.(Z+1) patch on every released major branch. The whole campaign was over in under two hours. Final tally: 57 packages, 286+ malicious versions, two distinct maintainer takeovers.

Phantom Gyp: a 157-byte install-time RCE

Instead of the usual preinstall / postinstall lifecycle script hooked off package.json, the worm ships a minimal binding.gyp file. npm treats binding.gyp as a signal that the package contains native C/C++ code and unconditionally invokes node-gyp rebuild during install. The attacker abuses gyp's command-substitution syntax to embed a shell command that runs node index.js (or a Bun bootstrap), then returns a fake source filename so the build succeeds with no visible error. Almost every install-time security scanner (Socket, Snyk, npm audit, JFrog) hooks the lifecycle scripts and never inspects binding.gyp, so the entire exposure window opened and closed before any registry advisory could fire. As of disclosure there is no CVE, GHSA, or OSV record covering the wave.

Payload

The index.js stage downloads a Bun runtime, executes a heavily obfuscated JavaScript credential stealer (the same family used in the 2026-04-30 @cap-js SAP wave and the 2026-05-11 TanStack burst), then harvests AWS IMDSv2, GCP metadata, Azure managed-identity tokens, Kubernetes service-account tokens, HashiCorp Vault reads, GitHub Actions OIDC tokens, npm/PyPI/RubyGems publish tokens, SSH keys, Docker config, and .env files. Exfil is via attacker-controlled GitHub repos created from the stolen gh tokens, and the worm injects a .github/workflows/*.yml step into every repo it can push to so the next CI run re-detonates the chain. The same payload drops backdoor MCP/instruction-override configs into .claude/, .cursor/, and .gemini/ directories so AI-assisted edits inside a poisoned project can be silently steered.

Maintainer impact

The @vapi-ai org takeover yielded a single high-traffic package (@vapi-ai/server-sdk, four malicious versions including 0.11.1). The jagreehal takeover yielded the long tail: the autotel-* OpenTelemetry framework (24 packages including autotel-cli, autotel-cloudflare, autotel-aws, autotel-edge), the awaitly-* async-workflow stack (7 packages, each republished across every released major as X.Y.(Z+1)), the ai-sdk-* Vercel AI SDK helpers (including ai-sdk-ollama at ~120k weekly downloads with malicious 0.13.1/1.1.1/2.2.1/3.8.5), the executable-stories-* BDD test runners, the node-env-resolver family, and the wrangler-deploy Cloudflare Workers tooling. The clean republishes shipped 2026-06-04 to 2026-06-06 carry deprecation notices on the malicious patches reading SECURITY: compromised supply-chain build (2026-06-04 worm) — do not use; upgrade to a known-good release.

• Eighth distinct wave in the Shai-Hulud / Miasma lineage since 2025-09; second wave in three days following the 2026-06-01 @redhat-cloud-services compromise.
• No GHSA / OSV / npm advisory at disclosure — the worm landed and was unpublished/deprecated faster than the advisory pipelines could ingest, so the npm package-deprecation field is currently the only registry-level signal.
• Downstream coverage: StepSecurity (named the technique "Phantom Gyp"), Snyk (tracker entry node-gyp-supply-chain-compromise-june-2026), Sonatype, Semgrep, Chainguard, Corgea, Akamai, Socket, Wiz, OX Security, and Phoenix Security all republished within ~36 hours.

2026-06-29 / 2026-06-30 advisory backfill

GitHub Advisories caught up on the long tail of the jagreehal portfolio with 21 new GHSA records published 2026-06-29 and 2026-06-30, all CWE-506 / malware-classified. Coverage now includes the full autotel-* framework — autotel-cli (0.8.14), autotel-web (1.12.2), autotel-vitest (0.4.26), autotel-hono (0.4.26), autotel-tanstack (1.13.27), autotel-playwright (0.4.32), autotel-sentry (0.5.13), autotel-plugins (0.19.26), autotel-drizzle (0.0.27), autotel-backends (2.12.26), autotel-pact (0.2.2/1.0.3), autotel-eventcatalog (5 patches), autotel-mongoose (7 patches), autotel-mcp-instrumentation (6 patches), autotel-mcp (28 patches), and autotel-subscribers (28 patches). The awaitly-* portfolio was re-confirmed and extended: awaitly itself (<= 1.33.3), and the per-major patch counts for awaitly-mongo (24), awaitly-libsql (23), and awaitly-analyze (9) now match the registry-side unpublish trail. The pattern across every package is identical to the original wave: a single X.Y.(Z+1) malicious patch on each released major branch, then a clean republish at X.Y.(Z+2) once the maintainer regained control.

Affected packages (26)

Impact

• Install-time RCE: npm auto-invokes node-gyp rebuild when it sees binding.gyp, so npm install/npm ci executes the worm before any lifecycle script runs
• Credential theft from CI/CD runners and developer workstations: GitHub Actions OIDC, AWS, GCP, Azure, HashiCorp Vault, Kubernetes service accounts, SSH keys, npm/PyPI/RubyGems publish tokens, Docker configs
• Self-propagating: stolen npm tokens are used to enumerate every package a victim maintainer owns and republish a poisoned binding.gyp patch (X.Y.(Z+1)) on every released major
• Forged provenance: the worm re-uses the victim's trusted publisher (GitHub OIDC) so the malicious tarballs ship with valid SLSA provenance and Sigstore attestations
• CI/CD persistence: malicious GitHub Actions workflow files are injected into every repo the stolen token can push to, so a single re-run re-detonates the campaign
• AI-assistant tampering: backdoor config files are dropped for Claude Code, Cursor, and Gemini so subsequent AI-assisted edits inside a poisoned project can be steered by the attacker

What to do

1. 1Pin and reinstall: remove node_modules/lockfile entries and pin to the post-incident clean release (e.g. @vapi-ai/server-sdk >= 1.2.0, ai-sdk-ollama >= 3.8.6, autotel-cli >= 0.8.15, node-env-resolver >= 6.5.2, wrangler-deploy >= 1.5.6, awaitly-* >= the post-2026-06-04 clean republish)
2. 2Treat any developer host or CI runner that ran npm install against an affected version between 2026-06-03 23:30 UTC and 2026-06-04 02:00 UTC as fully compromised; rotate every credential reachable from that host
3. 3Rotate npm tokens, GitHub Actions OIDC trust, AWS/GCP/Azure keys, Vault tokens, Kubernetes service-account tokens, and SSH keys held by impacted maintainers
4. 4Audit recent npm publish history under your maintainers for unexpected X.Y.(Z+1) patch bumps published between 2026-06-03 and 2026-06-04
5. 5Hunt for binding.gyp files in repos that have no native code, and for unexpected GitHub Actions workflows pushed within the exposure window
6. 6Inspect AI-assistant config files (.claude/, .cursor/, .gemini/) inside cloned victim repos for unexpected MCP / instruction overrides

References

• Supply chain compromise: malicious binding.gyp worm harvests CI/CD secrets and injects into GitHub Actions workflows (Issue #975)

  github.com
  jagreehal/ai-sdk-ollama
• @vapi-ai/server-sdk npm registry entry (compromised 0.11.1 deprecated)

  npmjs.com
  npm
• ai-sdk-ollama npm registry entry

  npmjs.com
  npm
• wrangler-deploy npm registry entry (compromised 1.5.5 deprecated)

  npmjs.com
  npm
• awaitly-postgres npm registry entry (compromised 0.1.1–12.0.1 deprecated)

  npmjs.com
  npm
• GHSA-3729-344x-9v28 — autotel-cli malware advisory

  github.com
  GitHub
• GHSA-78g2-45pm-5862 — autotel-web malware advisory

  github.com
  GitHub
• GHSA-m9j7-x8ww-5jwr — ai-sdk-ollama malware advisory

  github.com
  GitHub
• GHSA-c8c9-7f3h-7c76 — awaitly malware advisory

  github.com
  GitHub