Miasma binding.gyp Phantom Gyp - node-gyp Spawning Obfuscated index.js or Bun

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects anomalous execution patterns involving Node.js and Bun runtimes, specifically identifying suspicious process lineage such as node processes spawned by node.gyp, or Bun execution patterns involving temporary files or specific command-line arguments. Additionally, it alerts on the execution of a specific known malicious file hash.