The create-cf-token npm package versions 1.1.2 and 1.1.3 were found to contain malicious code or dependencies with malicious code. The malware, identified as Miasma, uses weaponized binding.gyp files to achieve execution during package installation, circumventing security tools that only inspect lifecycle scripts. Upon execution, it attempts to steal credentials and OIDC tokens for various cloud and registry services. It further propagates by compromising other npm packages managed by the stolen accounts or by committing backdoor files to GitHub repositories, enabling widespread infection and persistence.

Malicious code in the affected create-cf-token package versions can lead to credential and token theft for cloud and registry services. This enables unauthorized access and potential compromise of cloud resources and npm packages. The malware's self-propagation mechanism can cause widespread infection across the npm ecosystem and associated GitHub repositories, increasing the risk of supply chain attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or removal is confirmed, users should avoid using create-cf-token versions 1.1.2 and 1.1.3. Review and audit dependencies for signs of compromise and consider rotating any potentially exposed credentials or tokens. Monitor for updates from the package maintainers or security advisories for remediation.