Detecting npm Native Addon Malware: node-gyp Abuse
Source Reddit Malware
Discussion
This threat concerns malware abusing the npm native addon build tool node-gyp to execute malicious code. The detection approach involves analyzing binding.gyp files for suspicious shell execution patterns, undeclared build configurations, and suspicious dependencies. Additional detection criteria include C/C++ pattern matching and validation of prebuilt binaries. A detection tool, npm-scan v1.2.1, has been released to identify such abuses with reported 100% validation on known malicious samples. There is no indication of active exploitation in the wild or affected npm package versions. The threat was discussed in a Reddit post with minimal discussion and no external vendor advisory or patch information.
r/Malware (opens in a new tab)u/SaveAmerica20240 points0 comments
Detection approach:
\*\*1. binding.gyp Analysis\*\*
\- Flag shell execution patterns: \`<!(...")\` in gyp syntax
\- Check for suspicious dependencies that execute shell commands
\- Detect undeclared build configs (hidden from package.json)
Other criteria: \*\*2. C/C++ Pattern Matching\*\*, \*\*3. Prebuilt Binary Validation\*\*
Validation: 100% on real Phantom Gyp samples (@vapi-ai, abandoned-package, autotel).
Implementation: github.com/lateos-ai/npm-scan (D14 detector)
Release: npm-scan v1.2.1 | npm: @lateos/npm-scan@1.2.1