Phantom Gyp
The opera-cloaked worm of the Shai-Hulud family whose grand performance draws Mina into a gothic confrontation.
Phantom Gyp is an opera-cloaked member of the Shai-Hulud family. It turns the stage into its lair and confrontation into performance, meeting violence with all the ceremony of a grand production.
Appearance
Phantom Gyp is a pale, segmented worm with a ring-shaped toothed maw, four curved mandibles, and rows of fleshy nodules. A high-collared black opera cloak gives the creature its theatrical silhouette.
Silk on Slime
Phantom Gyp appears on an ornate opera-house stage opposite Mina, who watches from a balcony in gothic attire. The scene is associated with the song Silk on Slime.
Related Entries
Spoilers for The Shai-Hulud Family: A Taxonomy of Modern Supply Chain WormsShowHide
Security Metaphor
Phantom Gyp personifies the binding.gyp execution technique used by Miasma Wave 2 in June 2026. The campaign moved malicious execution out of npm lifecycle scripts and into binding.gyp, the configuration mechanism used by node-gyp for native Node.js modules.
The --ignore-scripts option still disables lifecycle scripts, but package installation can invoke other execution mechanisms. Phantom Gyp represents an attacker moving one layer lower after defenders blocked the more obvious path.
Package installation is therefore execution of untrusted supply-chain input, not a harmless file-copy operation. Defenses need to extend beyond lifecycle-script controls to isolated build environments, restricted network access, controlled native compilation, behavioral monitoring, and strict separation between build systems and valuable credentials.
