Latest / The Digital Warfare Podcast / Digital Warfare Podcast Daily Brief June 05, 2026
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we are covering a supply chain attack that spread across 57 NPM packages in under two hours, and did it using a method most security tools are not built to catch. Here is what happened. On June 3rd, researchers at Step Security identified a self-replicating worm spreading across the NPM registry. They named the technique Phantom GIP. The first package hit was the official VAPI.aivoice AI server SDK. With over four hundred eight thousand monthly downloads struck at eleven thirty PMU T C. Within one hour, more than fifty additional packages belonging to a separate maintainer were also poisoned. In total, fifty-seven packages across two hundred and eighty-six malicious versions were compromised. The method is precise. Instead of hiding malicious code inside package.json install scripts, which most security scanners are trained to watch. The attacker weaponized a one hundred fifty seven byte configuration file called binding dot gyp. When NPM sees that file, it automatically triggers a native build process. The attacker embedded a shell command inside GYP's own command substitution syntax, launching the malicious payload silently while returning a fake source file name so the build shows no errors. Standard install script scanners see nothing suspicious at all. The payload itself is layered under four stages of obfuscation: a ROT cipher, AES 128 encryption, and a runtime switching trick that downloads the bun JavaScript runtime in under one second to execute the final stage outside of node.js. That last move specifically evades security tooling that only monitors node.js process activity. One quick signal the malicious root index.js file weighs four point five megabytes. The legitimate package entry point is twenty seven kilobytes. That size gap alone should trigger immediate scrutiny. Once active, the malware targets CI slash C D environments directly. It harvests AWS keys, GCP credentials, Azure tokens, HushyCorp Vault tokens, GitHub Action Secrets, and one password vaults. It scrapes GitHub Actions runner memory to pull masked secrets in unmasked form. The same technique seen in the Tanstack compromise from May. Stolen credentials are encrypted and uploaded to attacker-controlled GitHub repositories the worm then propagates. It uses stolen NPM tokens to enumerate every package the compromise maintainer owns, injects the binding. And republishes with forged SLSA provenance and sig store signatures, making the re-infected packages appear fully legitimate even to supply chain integrity tools. And then it goes a step further. The malware injects backdoor configuration files into AI coding assistance, clawed code, cursor, Gemini, and VS code. Every AI assisted code suggestion inside a poison project could be quietly influenced by the attacker. The threat actor left a taunt. In one hundred and ninety-five GitHub repository descriptions, a reversed string that decodes to Shy Hulud, here we go again, a direct reference to Step Security's prior Red Hat analysis two days earlier. This is not opportunistic. It is deliberate, persistent and escalating. Here is what you do now. First, audit every repository and CI pipeline for affected packages. Treat all credentials from any potentially compromised environment as stolen and rotate them immediately. Do not wait to confirm. Second, search your project repositories for injected AI assistant files. Claude slash setup dot mjs.cursor slash rules slash setup dot MDC and dot vscode slash setup dot mjs. Their presence indicates compromise. Third, Block outbound network access to the attacker-controlled GitHub account and the bun runtime download endpoint as an immediate containment measure. Fourth, add binding. A 157-byte binding dot GIP in a package that has no legitimate native code dependency is a red flag. The strategic lesson: your supply chain security posture is only as strong as As what your scanners are actually built to detect. This attack did not break your tools, it walked around them. If your NPM security scanning covers only package.json install scripts, you have a visible gap that adversaries are already aware of and actively exploiting. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.