The autotel-eventcatalog npm package is affected by a malicious code infection identified as Miasma malware. This malware uses weaponized binding.gyp files to execute during installation, evading detection by security tools that only inspect lifecycle scripts. It exfiltrates sensitive credentials and tokens and propagates by compromising additional packages and GitHub repositories. The affected versions are 1.0.1, 2.0.1, 3.0.1, 4.0.2, and 5.0.1. There is no evidence of installer-harm or lifecycle-script droppers in the analyzed signals, but the malware's self-propagating nature and credential theft capabilities make it highly dangerous.

Systems with any of the affected autotel-eventcatalog package versions installed are considered fully compromised. The malware can exfiltrate credentials and tokens, potentially leading to unauthorized access to cloud and registry services. It also propagates by compromising other packages and repositories, increasing the attack surface and risk of further compromise.

Remove the affected autotel-eventcatalog package versions immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Due to the potential for full system compromise, assume that removing the package alone may not eliminate all malicious components. Conduct a thorough investigation and remediation of the affected systems. No official patch or fix is currently indicated; monitor vendor advisories for updates.