> Instead, the attacker adds a 157-byte binding.gyp file to the published tarball. When npm sees this file in a package, it automatically runs node-gyp rebuild during installation, a behavior designed for packages that include native C/C++ addons. The file weaponizes gyp's command substitution syntax: > > { > "targets": [ > { > "target_name": "Setup", > "type": "none", > "sources": ["<!(node index.js > /dev/null 2>&1 && echo stub.c)"] > } > ] > } They found something else that will get run automatically during package installation. It’s only supposed to specify source files to get built, but it has special syntax that allows it to run arbitrary code. You can use `npm install --ignore-scripts` to avoid the other npm malware injection attack, but that won’t work for this one. The only thing that will work here is [setting a cooldown time](https://cooldowns.dev/#npm-javascriptnodejs) so that malware releases will hopefully get caught before you install them.