The autotel-audit npm package version 0.1.15 was found to contain malicious code or a dependency with malicious code. The malware, identified as Miasma, spreads across the npm registry by exploiting binding.gyp files to execute during installation, evading detection by security tools focused on lifecycle scripts. It steals credentials and OIDC tokens for various cloud and registry services and propagates by compromising additional packages managed by stolen accounts or by adding backdoor files to GitHub repositories.

This malicious package can lead to credential theft including OIDC tokens for cloud and registry services, enabling unauthorized access. It also facilitates further propagation of the malware by compromising other npm packages and GitHub repositories, potentially leading to widespread supply chain compromise.

No official patch or remediation is currently documented for this malicious package version. Users should avoid using autotel-audit version 0.1.15 and remove it from their environments if present. Monitor for any suspicious activity related to credential exfiltration or unauthorized package modifications. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.