Full Report
The attack is notable for its breadth, flooding npm with malicious package versions.
Analysis Summary
# Tool/Technique: Malicious `binding.gyp` Injection
## Overview
This technique involves the abuse of the `node-gyp` build system within the npm ecosystem. By placing a malicious `binding.gyp` file in a package root, attackers can achieve arbitrary code execution during the `npm install` process. This method bypasses standard security audits that focus on `preinstall` and `postinstall` scripts, as `binding.gyp` is triggered automatically by npm as a native build configuration.
## Technical Details
- **Type:** Technique / Malware (Supply Chain Attack)
- **Platform:** Cross-platform (Node.js/npm environments, CI/CD pipelines)
- **Capabilities:** Silent code execution, secret exfiltration, persistence via "dead man's switch" logic, evasion of lifecycle script monitoring.
- **First Seen:** June 3–4, 2026
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1195.002 - Supply Chain Compromise: Compromise Software Dependencies
- **TA0002 - Execution**
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- **TA0006 - Credential Access**
- T1552 - Unsecured Credentials (CI/CD secrets, Environment Variables)
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols
## Functionality
### Core Capabilities
- **Silent Trigger:** Exploits `node-gyp` to execute commands automatically during installation without using the `scripts` field in `package.json`.
- **Arbitrary Command Execution:** Uses GYP shell expansion (`<!(cmd)`) to run system commands or Node.js scripts (e.g., `node index.js`).
- **Output Suppression:** Utilizes `/dev/null 2>&1` to hide execution logs from the terminal, making the installation appear normal.
- **Credential Theft:** Specifically targets environment variables and CI/CD secrets stored in developer environments.
### Advanced Features
- **Multi-layer Encryption:** The payload is encrypted three layers deep to evade static analysis and basic string detection.
- **Persistence/Dead Man's Switch:** Implements logic where revoking a stolen token may trigger secondary malicious actions, complicating incident response.
- **Rapid Flooding:** Automated deployment of hundreds of versions (286+ versions) across dozens of package families (56+ packages) to maximize reach.
## Indicators of Compromise
- **File Names:** `binding.gyp`, `index.js` (malicious variant), `stub.c` (referenced but often non-existent).
- **Behavioral Indicators:**
- `npm` process spawning unexpected shell commands or network connections during the build phase.
- Presence of a `binding.gyp` file in a pure JavaScript/TypeScript package that does not require native C++ bindings.
- Outbound POST requests to unknown endpoints containing base64 or encrypted strings immediately after `npm install`.
## Associated Threat Actors
- **Unknown** (Attributed to the "autotel" / "awaitly" campaign actors).
## Detection Methods
- **Signature-based detection:** Scanning for `binding.gyp` files containing the specific shell expansion string: `<!(node index.js > /dev/null 2>&1 && echo stub.c)`.
- **Behavioral detection:** Monitoring for unexpected child processes spawned by `node-gyp` or `npm`.
- **Static Analysis:** Identifying "Pure JS" packages that unexpectedly include native build configuration files (`.gyp`, `.c`, `.cpp`).
## Mitigation Strategies
- **Audit Configuration Files:** Expand security checklists to include `binding.gyp` and other build-time configurations, not just `package.json` scripts.
- **Use --ignore-scripts:** Run `npm install --ignore-scripts` to prevent the execution of lifecycle hooks and build tools, though this may break packages requiring legitimate native builds.
- **Environment Isolation:** Use ephemeral CI/CD runners and restricted environment variable access to limit the impact of secret theft.
- **Dependency Pinning:** Use lockfiles (`package-lock.json`) and strictly audit new dependency versions before updating.
## Related Tools/Techniques
- **Typosquatting:** Often used in conjunction to trick developers into installing the malicious packages.
- **Protestware:** Similar delivery mechanism via lifecycle hooks.
- **Dependency Confusion:** Another method of infiltrating the supply chain.