Digital Warfare Podcast Daily Brief June 05, 2026

The Digital Warfare Podcast · Jun 5, 2026 · 4m · transcript

Summary

A self-replicating worm dubbed Phantom Gyp compromised 57 npm packages across 286 malicious versions on June 3, 2026, spreading across multiple high-download maintainer accounts in under two hours. The attacker weaponized a 157-byte binding.gyp configuration file to trigger code execution at install time, completely bypassing standard package.json install-script security scanners. The four-stage obfuscated payload harvested multi-cloud credentials from CI/CD environments, propagated itself using stolen npm tokens with forged supply chain integrity signatures, and injected backdoors…