--- title: Wait, binding.gyp Can Do What? Exploring npm's Weirdest... description: A deep dive into how binding.gyp, the npm native build configuration file, can be abused to execute arbitrary code at install time without any package.json... canonical: https://daily.dev/posts/wait-binding-gyp-can-do-what-exploring-npm-s-weirdest-build-system-emiwf9vpy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System | daily.dev og:description: A deep dive into how binding.gyp, the npm native build configuration file, can be abused to execute arbitrary code at install time without any package.json... og:url: https://daily.dev/posts/wait-binding-gyp-can-do-what-exploring-npm-s-weirdest-build-system-emiwf9vpy og:image: https://api.daily.dev/og/posts/EmIWf9vpY.png og:image:alt: Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System **[Aikido Security](https://daily.dev/sources/aikido-security)** · 18 min read · 1 upvotes · 0 comments ## Summary A deep dive into how binding.gyp, the npm native build configuration file, can be abused to execute arbitrary code at install time without any package.json lifecycle hooks. The post is prompted by the Miasma supply chain attack, which moved its payload from preinstall scripts into binding.gyp. Multiple attack vectors are covered: GYP command expansions ( ## Similar posts on daily.dev - [binding.gyp: An npm Supply Chain Attack That Spreads Like a Worm](https://daily.dev/posts/binding-gyp-an-npm-supply-chain-attack-that-spreads-like-a-worm-3wr811hzs) · StepSecurity · 2 upvotes · 0 comments - [Node-gyp Supply Chain Compromise](https://daily.dev/posts/node-gyp-supply-chain-compromise-fjrma3w8k) · Snyk · 0 upvotes · 0 comments - [Multiple @immobiliarelabs Backstage Plugins Compromised on npm](https://daily.dev/posts/multiple-immobiliarelabs-backstage-plugins-compromised-on-npm-mryfkuxnt) · StepSecurity · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/wait-binding-gyp-can-do-what-exploring-npm-s-weirdest-build-system-emiwf9vpy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System","url":"https://daily.dev/posts/wait-binding-gyp-can-do-what-exploring-npm-s-weirdest-build-system-emiwf9vpy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/wait-binding-gyp-can-do-what-exploring-npm-s-weirdest-build-system-emiwf9vpy"},"datePublished":"2026-06-09T14:19:13.145Z","dateModified":"2026-06-09T14:19:38.599Z","description":"A deep dive into how binding.gyp, the npm native build configuration file, can be abused to execute arbitrary code at install time without any package.json...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2dcf288f0b2b5564a7b5fadabd97d002?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2dcf288f0b2b5564a7b5fadabd97d002?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/wait-binding-gyp-can-do-what-exploring-npm-s-weirdest-build-system-emiwf9vpy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,malware,npm","timeRequired":"PT18M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System"}]} ```