Malicious npm Packages Spread Through `binding.gyp` Across Popular JavaScript Libraries

Security researchers reported a renewed npm supply-chain campaign affecting a wide range of JavaScript and TypeScript packages, with malicious versions published across families including autotel, awaitly, executable-stories, node-env-resolver, AI SDK components, telemetry libraries, and ESLint-related tooling. StepSecurity described the activity as a binding.gyp-based attack that spreads "like a worm," while OX Security linked the activity to the returning Miasma campaign and said the affected packages collectively account for roughly 647,000 monthly downloads.

The published notices focus on package exposure rather than a CVE-style vulnerability disclosure, listing compromised package names and exact version numbers as the primary indicators of risk. Across both reports, the incident is characterized as a software supply-chain compromise in the npm ecosystem, with no confirmed threat actor attribution, malware family details beyond the Miasma label, or technical exploit chain disclosed in the available summaries.