The creditcard.js npm package versions 2.1.8 and 3.0.60 have been found to contain malicious code linked to the Miasma malware. Miasma spreads across the npm registry by exploiting weaponized binding.gyp files, which execute during package installation and bypass security tools that only inspect lifecycle scripts. Once executed, the malware attempts to steal credentials and OIDC tokens for various cloud and registry services. It further propagates by compromising other npm packages managed by the stolen accounts or by committing backdoor files to GitHub repositories. There is no CVSS score or vendor advisory available, and no known exploits in the wild have been reported.

The malicious code can lead to credential and token theft for cloud and registry services, potentially allowing attackers to compromise additional packages and repositories. This can result in widespread supply chain compromise within the npm ecosystem and associated cloud environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid using the affected versions (=2.1.8 and =3.0.60) of creditcard.js. Monitor for updates from the package maintainers or npm security advisories regarding remediation or package removal.