The @ethlete/cli package version 2.0.1 was found to include malicious code or dependencies containing malicious code. Specifically, it is linked to the Miasma malware, a self-propagating worm that spreads across the npm registry by exploiting binding.gyp files to execute during installation, circumventing detection by tools focused on lifecycle scripts. The malware's actions include credential and OIDC token theft from cloud and registry services, and propagation through compromised packages or GitHub repositories.

The malicious code can lead to credential and OIDC token theft for various cloud and registry services, potentially allowing unauthorized access and further compromise. It also enables the malware to propagate by compromising additional packages or injecting backdoors into repositories, increasing the attack surface and risk to the software supply chain.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using @ethlete/cli version 2.0.1. Review and audit dependencies for malicious code and consider removing or replacing affected packages. Monitor for updates from the package maintainers or security advisories regarding remediation.