The autotel-mcp package on npm is infected with the Miasma malware, which uses weaponized binding.gyp files to execute code during installation, bypassing security tools that only inspect lifecycle scripts. It attempts credential and token exfiltration for cloud and registry services and spreads by compromising other packages or injecting backdoors into GitHub repositories. While initial pattern-based detection noted 'ping' and 'POST' strings, further analysis confirmed malicious intent. Systems with this package installed are considered fully compromised, requiring secret rotation and package removal, though removal may not fully clean the system.

Any computer with the autotel-mcp package installed is considered fully compromised, risking exposure of all stored secrets and keys. The malware can exfiltrate credentials and OIDC tokens for cloud and registry services, potentially leading to further compromise of cloud environments and software supply chains. The malware also propagates by compromising other npm packages and GitHub repositories, increasing the risk of widespread infection.

Remove the autotel-mcp package immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems from a different, secure computer. Because full control of the system may have been given to an attacker, additional forensic analysis and remediation may be necessary to ensure complete removal of malicious software. Monitor for any unauthorized access or changes in related cloud and repository accounts.