The @ethlete/theming npm package at version 2.7.1 was found to contain malicious code linked to the Miasma malware. Miasma is a self-propagating worm that spreads within the npm ecosystem by exploiting binding.gyp files to execute malicious code during package installation, circumventing detection by security tools that focus on lifecycle scripts. The malware's payload includes exfiltration of credentials and OIDC tokens for various cloud and registry services, enabling further compromise. It propagates by taking over other packages managed by stolen accounts or by injecting backdoor files into GitHub repositories, facilitating widespread infection.

This malicious package can lead to credential theft, including cloud and registry service tokens, potentially allowing attackers to compromise additional packages and repositories. This can result in supply chain attacks affecting downstream users who install or update the compromised package version.

No official patch or remediation guidance is provided for this package version. Users should avoid using @ethlete/theming version 2.7.1 and remove it from their projects if present. Monitor for updates or advisories from the package maintainers or npm registry. Consider auditing dependencies for malicious code and rotating any potentially exposed credentials or tokens.