Malicious code in autotel-devtools (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e1bce8c001a8e85b493ccdd8af1e3e57f3578d1026e6d5d147374b0a68467313) autotel-devtools ships bundled CommonJS and ESM artifacts (dist/cli.cjs, dist/cli.js, dist/index.cjs, dist/index.js, dist/server/index.cjs, dist/server/index.js, dist/widget.global.js) where pattern matches surfaced co-occurrence of Buffer.from(..., 'base64') decoding alongside HTTP POST and 'ping' tokens. The package is presented as a developer-tools CLI/server, which legitimately bundles command names and HTTP clients into a single rollup output, and the matched primitives are consistent with that shape (e.g. base64 token decoding, POST against a configurable backend, a 'ping' subcommand or health-check string). No specific attacker-controlled destination, env-var scraping, credential path read, or install-time lifecycle hook was identified, and the keyword proximity inside minified bundles is the weakest evidence shape. A human reviewer should de-minify the relevant spans around dist/cli.cjs:534 and dist/index.cjs:143 to confirm whether the POST destinations are user-configurable backends or a hardcoded endpoint, and whether the base64 decode handles a JWT/session token or executes decoded bytes. ## Source: ghsa-malware (1d9ead83772087e781dd41428b81aec15c104b5064f20f0c47e911025942bd01) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: google-open-source-security (a6c7977dbc054cdb7fe56da0d2fbd26e2a6fed695deb4263ccbf4adfedd86acb) The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` files to achieve execution during package installation, bypassing security tools that only inspect package lifecycle scripts. Upon execution, the malware attempts to exfiltrate credentials and OIDC tokens for various cloud and registry services, and propagates by compromising other packages managed by the stolen accounts or committing backdoor files to GitHub repositories.
AI Analysis
Technical Summary
The autotel-devtools package versions 0.1.1, 1.0.4, 2.1.1, 3.0.2, 4.0.1, 5.1.1, 6.1.2, and 6.2.0 contain malicious code known as Miasma malware. This malware abuses weaponized binding.gyp files to execute code during installation, bypassing lifecycle script inspections. It attempts to exfiltrate credentials and OIDC tokens for cloud and registry services and propagates by compromising other npm packages and GitHub repositories. Analysis of bundled artifacts shows base64 decoding and HTTP POST usage consistent with malicious activity, though exact endpoints and payloads require further human review. The malware effectively grants full control of the infected system to attackers.
Potential Impact
Systems with autotel-devtools installed or running are considered fully compromised. Attackers may have obtained all secrets and keys stored on the system. The malware can spread to other packages and repositories, increasing the attack surface. Removal of the package alone does not guarantee eradication of all malicious software introduced by the malware.
Mitigation Recommendations
Immediate removal of the autotel-devtools package is required. All secrets and keys stored on the compromised system should be rotated from a separate, trusted device. Due to the potential for full system compromise and persistence, a thorough incident response and system integrity verification are recommended. No official patch or fix is indicated; remediation relies on removal and credential rotation.
Malicious code in autotel-devtools (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e1bce8c001a8e85b493ccdd8af1e3e57f3578d1026e6d5d147374b0a68467313) autotel-devtools ships bundled CommonJS and ESM artifacts (dist/cli.cjs, dist/cli.js, dist/index.cjs, dist/index.js, dist/server/index.cjs, dist/server/index.js, dist/widget.global.js) where pattern matches surfaced co-occurrence of Buffer.from(..., 'base64') decoding alongside HTTP POST and 'ping' tokens. The package is presented as a developer-tools CLI/server, which legitimately bundles command names and HTTP clients into a single rollup output, and the matched primitives are consistent with that shape (e.g. base64 token decoding, POST against a configurable backend, a 'ping' subcommand or health-check string). No specific attacker-controlled destination, env-var scraping, credential path read, or install-time lifecycle hook was identified, and the keyword proximity inside minified bundles is the weakest evidence shape. A human reviewer should de-minify the relevant spans around dist/cli.cjs:534 and dist/index.cjs:143 to confirm whether the POST destinations are user-configurable backends or a hardcoded endpoint, and whether the base64 decode handles a JWT/session token or executes decoded bytes. ## Source: ghsa-malware (1d9ead83772087e781dd41428b81aec15c104b5064f20f0c47e911025942bd01) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: google-open-source-security (a6c7977dbc054cdb7fe56da0d2fbd26e2a6fed695deb4263ccbf4adfedd86acb) The Miasma malware is a self-propagating worm that spreads across the npm registry by abusing weaponized `binding.gyp` files to achieve execution during package installation, bypassing security tools that only inspect package lifecycle scripts. Upon execution, the malware attempts to exfiltrate credentials and OIDC tokens for various cloud and registry services, and propagates by compromising other packages managed by the stolen accounts or committing backdoor files to GitHub repositories.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The autotel-devtools package versions 0.1.1, 1.0.4, 2.1.1, 3.0.2, 4.0.1, 5.1.1, 6.1.2, and 6.2.0 contain malicious code known as Miasma malware. This malware abuses weaponized binding.gyp files to execute code during installation, bypassing lifecycle script inspections. It attempts to exfiltrate credentials and OIDC tokens for cloud and registry services and propagates by compromising other npm packages and GitHub repositories. Analysis of bundled artifacts shows base64 decoding and HTTP POST usage consistent with malicious activity, though exact endpoints and payloads require further human review. The malware effectively grants full control of the infected system to attackers.
Potential Impact
Systems with autotel-devtools installed or running are considered fully compromised. Attackers may have obtained all secrets and keys stored on the system. The malware can spread to other packages and repositories, increasing the attack surface. Removal of the package alone does not guarantee eradication of all malicious software introduced by the malware.
Mitigation Recommendations
Immediate removal of the autotel-devtools package is required. All secrets and keys stored on the compromised system should be rotated from a separate, trusted device. Due to the potential for full system compromise and persistence, a thorough incident response and system integrity verification are recommended. No official patch or fix is indicated; remediation relies on removal and credential rotation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5218
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-r65m-xcg9-hvfh"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a42ed2927e9c79719934b02
Added to database: 06/29/2026, 22:09:45 UTC
Last enriched: 07/10/2026, 12:07:18 UTC
Last updated: 07/30/2026, 16:44:41 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.