Supply Chain attack abusing the binding.gyp build mechanism used to execute malicious code during package installation. This campaign uses a malicious binding.gyp file to trigger code execution through node-gyp.
Source: Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp - StepSecurity
