The autotel-pact npm package versions =0.2.2 and =1.0.3 were found to contain malicious code identified as Miasma malware. This malware leverages weaponized binding.gyp files to execute during package installation, bypassing typical security inspections focused on lifecycle scripts. Upon execution, it exfiltrates credentials and OIDC tokens for cloud and registry services and propagates by compromising other npm packages and GitHub repositories managed by the stolen accounts. The infection leads to full compromise of affected systems.

Systems with autotel-pact versions 0.2.2 or 1.0.3 installed are fully compromised. The malware can exfiltrate sensitive credentials and tokens, potentially leading to unauthorized access to cloud and registry services. It also propagates by compromising other packages and repositories, increasing the scope of infection. Secrets and keys stored on affected machines must be considered compromised and rotated immediately from a secure, unaffected system.

There is no official patch or fix available for this malicious package. Immediate removal of autotel-pact versions 0.2.2 and 1.0.3 is recommended. However, because the malware may have fully compromised the system, all secrets and keys stored on the affected machine should be rotated from a different, secure computer. Consider rebuilding or isolating affected systems to ensure complete removal of the malware.