[email protected] includes a bundled HTTP server module flagged for suspicious use of require("child_process"), HTTP POST/GET calls, and the string "ping". While the package legitimately exposes HTTP routes and may shell out, the presence of these keywords raised concerns. The package is linked to the Miasma malware, which spreads across the npm registry by abusing binding.gyp files to execute code during installation, evading lifecycle script inspections. Miasma attempts credential and token exfiltration and propagates by compromising other packages and GitHub repositories. Behavioral tracing of the executable-stories-mcp bundle is incomplete, so the exact nature of the malicious activity is not fully confirmed.

If exploited, the malware could exfiltrate sensitive credentials and OIDC tokens for cloud and registry services, potentially leading to unauthorized access and further compromise of other npm packages and GitHub repositories. The propagation mechanism allows the malware to spread widely within the npm ecosystem, increasing the risk of supply chain attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, users should avoid using executable-stories-mcp version 0.3.3 and audit their environments for suspicious activity related to this package. Monitoring for updates from the package maintainers or security advisories is recommended.