npm Worm Bypasses Script Checks Via Build Metadata
The break is that package screening that only looks for npm lifecycle scripts can be fooled. Miasma v2 gets code to run during install through a tiny malicious binding.gyp file, so a package can look script-free and still execute a worm.
Semgrep says the worm has now spread to 57 npm packages across 286+ malicious versions. It harvests AWS, GCP, and Azure credentials, GitHub Actions secrets, and password-store data, then persists in AI coding-assistant configs and forges provenance so reinfected packages look legitimate.
That means the trust boundary has shifted from declared scripts to build metadata. Teams that treat “no preinstall/postinstall” as a safe sign are missing an install path that still runs attacker code and keeps spreading through the package ecosystem.