The npm package executable-stories-react version 0.1.7 is identified as containing malicious code linked to the Miasma malware. Miasma is a self-propagating worm that spreads across the npm registry by leveraging weaponized binding.gyp files to achieve execution during package installation, circumventing security tools that focus on lifecycle scripts. Upon execution, it attempts to steal credentials and OIDC tokens for various cloud and registry services. The malware further propagates by compromising other packages managed by the stolen accounts or by committing backdoor files to GitHub repositories.

The malicious code can lead to credential and token theft for cloud and registry services, potentially allowing unauthorized access and further compromise of software supply chains. It also enables propagation of the malware by compromising additional npm packages and GitHub repositories, increasing the attack surface and risk to dependent projects.

No official patch or remediation is currently documented for this package version. Users should avoid using executable-stories-react version 0.1.7. Review and remove this package if present in your dependencies. Monitor for updates from the package maintainers or npm security advisories for any official fixes or guidance.