The autotel-cloudflare package version 2.18.16 is infected with Miasma malware, a self-propagating worm that leverages weaponized binding.gyp files to execute code during npm package installation. This execution bypasses security tools that only inspect lifecycle scripts. The malware exfiltrates credentials and OIDC tokens for various cloud and registry services and spreads by compromising additional packages and injecting backdoors into GitHub repositories. Due to the nature of the compromise, removal of the package alone does not guarantee eradication of the malware or its persistence mechanisms.

Systems with autotel-cloudflare version 2.18.16 installed are fully compromised, risking exposure of all stored secrets and keys. The malware can exfiltrate sensitive credentials and tokens, potentially leading to further compromise of cloud and registry services. It also propagates by compromising other npm packages and GitHub repositories, increasing the attack surface and persistence.

Remove the autotel-cloudflare package version 2.18.16 immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Because the malware may have established persistence beyond the package itself, assume full system compromise and consider rebuilding the affected system. No official patch or fix is currently available; monitor vendor advisories for updates.