The dbmux npm package versions =1.0.5 and =2.2.5 include malicious code identified as Miasma malware. This malware self-propagates through the npm registry by exploiting weaponized binding.gyp files to execute code during package installation, bypassing security tools that focus on lifecycle scripts. Once executed, it attempts to steal credentials and OIDC tokens for cloud and registry services, enabling further compromise by spreading to other packages managed by the stolen accounts or by committing backdoor files to GitHub repositories. The presence of this package on a system indicates a full compromise, and removal alone may not eliminate all malicious components.

Any system with the affected dbmux package versions installed should be considered fully compromised. The malware can exfiltrate sensitive credentials and tokens, potentially leading to unauthorized access to cloud and registry services. It can also propagate further by compromising other packages and repositories, increasing the scope of the compromise. The threat undermines system integrity and confidentiality.

There is no official patch or fix available for this malicious package. Immediate removal of the dbmux package versions 1.0.5 and 2.2.5 is recommended. However, because the malware may have already established persistence and exfiltrated credentials, all secrets and keys stored on the affected system should be rotated from a different, trusted computer. Consider the affected system fully compromised and perform a thorough incident response and forensic analysis to ensure complete eradication of the malware.