Binding.gyp Supply Chain Attack Enables CI/CD Worm Propagation Across npm Packages (Campaign)

Researchers identified an active supply-chain campaign targeting multiple npm packages in which attackers compromised maintainer accounts and published malicious versions containing a crafted binding.gyp file. During installation, node-gyp executes attacker-controlled commands via shell expansion in the binding.gyp sources array, launching an obfuscated JavaScript payload and bypassing typical preinstall/postinstall checks and package review processes, enabling CI/CD-style worm propagation across packages.