The discord-search npm package versions 0.1.1 and 0.1.2 were found to contain malicious code or dependencies that include the Miasma malware. Miasma is a self-propagating worm that leverages weaponized binding.gyp files to execute during package installation, evading security tools that focus on lifecycle scripts. Once executed, it attempts credential and token theft for cloud and registry services and spreads by compromising additional packages or injecting backdoors into GitHub repositories managed by stolen accounts.

The malicious code enables unauthorized exfiltration of sensitive credentials and OIDC tokens, potentially compromising cloud and registry services. It also facilitates further propagation by compromising other npm packages and injecting backdoors into GitHub repositories, increasing the risk of widespread supply chain compromise.

No official patch or remediation is currently documented for discord-search versions 0.1.1 and 0.1.2. Users should avoid using these versions and remove them from their environments. Monitor vendor advisories or npm security updates for any forthcoming fixes or guidance. Since this is not a cloud service, remediation depends on user action.