The create-wrangler-deploy npm package version 0.1.1 is affected by malicious code identified as the Miasma malware. Miasma spreads through the npm registry by exploiting binding.gyp files to execute during package installation, circumventing security tools that focus on lifecycle scripts. Once executed, it attempts credential and token theft for cloud and registry services and propagates by compromising additional packages or inserting backdoors into GitHub repositories associated with stolen accounts.

The malware can lead to credential and OIDC token theft for various cloud and registry services, potentially enabling unauthorized access. It also facilitates further spread by compromising other npm packages and injecting backdoors into GitHub repositories, increasing the risk of supply chain attacks and persistent compromise.

No official patch or remediation is currently documented for this malicious package. Users should avoid using create-wrangler-deploy version 0.1.1 and any packages depending on it. Review and audit package dependencies carefully and monitor for updates or advisories from the package maintainers or npm registry. Since this is a malicious package rather than a vulnerability with a patch, removal and avoidance are the primary mitigations.