The 'wrangler-deploy' npm package version 1.5.5 is flagged as malicious due to its similarity to the official Cloudflare 'wrangler' CLI, which may mislead developers into installing it. Analysis detected suspicious code patterns involving network requests and base64 token handling consistent with potential credential exfiltration. The package is associated with the Miasma malware, which uses weaponized 'binding.gyp' files to execute code during installation, evading lifecycle script inspections. Miasma attempts to exfiltrate credentials and OIDC tokens and propagates by compromising other npm packages and GitHub repositories. No direct attacker-controlled endpoints or install-time hooks have been confirmed, and human review is ongoing to determine the exact nature of the package's behavior.

If installed, this malicious package could lead to credential and token theft for cloud and registry services, enabling unauthorized access and further compromise of developer accounts and repositories. The malware's self-propagating nature increases the risk of widespread infection across the npm ecosystem and associated GitHub repositories, potentially undermining supply chain security.

No official patch or fix is currently available for this malicious package. The best mitigation is to avoid installing 'wrangler-deploy' version 1.5.5 and to verify the authenticity of packages, especially those with names similar to official tools. Developers should audit their dependencies and remove any instances of this package. Monitor vendor advisories for updates or remediation guidance. Since this is not a cloud service, remediation depends on user action.