The autotel-playwright npm package version 0.4.32 includes malicious code known as Miasma malware, which self-propagates through the npm registry by exploiting binding.gyp files to execute code during installation, circumventing security tools that only inspect lifecycle scripts. The malware exfiltrates credentials and OIDC tokens for cloud and registry services and spreads by compromising additional packages and GitHub repositories via stolen accounts. Installation of this package results in a full compromise of the affected system.

Any computer with autotel-playwright version 0.4.32 installed is considered fully compromised. The malware can exfiltrate sensitive credentials and tokens, potentially leading to unauthorized access to cloud and registry services. It also propagates by compromising other packages and repositories, increasing the scope of impact beyond the initially infected system.

Immediate removal of the autotel-playwright package version 0.4.32 is recommended. However, because the system is likely fully compromised, all secrets and keys stored on the affected computer must be rotated from a separate, secure device. There is no guarantee that removing the package will eliminate all malicious software introduced by the malware. Monitor for any suspicious activity and consider rebuilding the affected system from a known good state.