Coordinated npm supply-chain worm wave, June 3-4 2026. An attacker published 58 packages (287 malicious versions) within roughly a two-hour window, each triggering a self-replicating credential stealer through a binding.gyp native-build install hook (Phantom Gyp) instead of a postinstall script - pulling a standalone Bun runtime and an AES-decrypted payload to harvest cloud (AWS/GCP/Azure/Vault), CI/CD OIDC, Kubernetes, and npm/GitHub/RubyGems registry tokens.