Vapi server SDK caught in the Phantom Gyp npm wave

A self-replicating npm worm poisoned 57 packages in less than two hours on June 3, 2026, and did it without touching the preinstall or postinstall hooks that most supply-chain scanners watch. The largest package caught in the wave was @vapi-ai/server-sdk, the server-side SDK for the voice-AI platform Vapi, which StepSecurity put at more than 408,000 downloads a month.

The technique, which StepSecurity named "Phantom Gyp," abused node-gyp, the build tool Node.js uses to compile native addons. A binding.gyp file describes how to build those addons, and it can contain shell commands that node-gyp evaluates while resolving the build. The attacker needed 157 bytes: a command of the form "<!(node index.js > /dev/null 2>&1 && echo stub.c)", which quietly executed the package's own index.js during installation. Nothing appeared in package.json, so tools that inventory lifecycle scripts saw a clean package.

What index.js ran was a four-layer unpacking chain: a ROT-N Caesar cipher fed to eval(), an AES-128-GCM decryption layer, a loader that downloaded the Bun JavaScript runtime, and finally the Miasma payload itself. Once resident, it swept for npm, GitHub, AWS, GCP, Azure, HashiCorp Vault, and Kubernetes credentials, pulled GitHub Actions secrets out of runner memory, and wrote startup hooks into the configuration directories of AI coding assistants including Claude Code and Cursor, so that a developer opening the project again would re-execute it.

Stolen material went to GitHub, where the account liuende501 held 236 programmatically created repositories used as drop boxes. Snyk, which tracked the same activity as a node-gyp supply-chain compromise, counted more than 300 malicious versions across the affected packages. The worm closed the loop by using the credentials it collected to republish trojanized versions from any maintainer account it could reach, which is how a technique demonstrated on one project arrived in 56 others the same afternoon.