The @forjacms/client npm package versions 1.8.4 and 1.8.5 were found to contain malicious code linked to the Miasma malware. Miasma is a self-propagating worm that leverages weaponized binding.gyp files to execute during package installation, circumventing detection by security tools focused on lifecycle scripts. Upon execution, it attempts to steal credentials and OIDC tokens for various cloud and registry services. The malware then propagates by compromising other npm packages managed by the stolen accounts or by injecting backdoor files into GitHub repositories, facilitating further spread and persistence.

Malicious code in the affected package versions can lead to credential and token theft for cloud and registry services, enabling unauthorized access. This can result in further compromise of other npm packages and GitHub repositories through propagation mechanisms. Although no known exploits in the wild are reported, the potential for widespread compromise exists due to the malware's self-propagating nature.

No official patch or remediation is currently documented for the affected versions. Users should avoid using @forjacms/client versions 1.8.4 and 1.8.5. Monitor vendor advisories for updates or fixes. Consider removing or replacing the affected package versions in your environment to prevent potential compromise.