Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-propagates across maintainers. Node-gyp Supply Chain Compromise | Snyk You need to enable JavaScript to run this app. Skip to main content Platform Platform Snyk AI Security Platform Modern security in…

https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp

sha256:3bbabd51d8ab1e6254481a7e5be4a7532b25114f7ac2c1013a1386af32598e25

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url6
ipv41
ipv60
sha10
domain17
sha2560
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	github.com	Open →
domain	package.json	Open →
domain	package-lock.json	Open →
domain	settings.json	Open →
domain	registry.npmjs.org	Open →
domain	api.github.com	Open →
domain

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports