The @forjacms/sections-react npm package versions 1.8.4 and 1.8.5 are affected by the Miasma malware, a self-propagating worm that exploits weaponized binding.gyp files to execute malicious code during package installation. This technique bypasses security tools that only inspect lifecycle scripts. Once executed, the malware attempts to steal credentials and OIDC tokens for various cloud and registry services. It further propagates by compromising other npm packages managed by the stolen accounts or by committing backdoor files to GitHub repositories. This behavior indicates a supply chain compromise risk through npm packages.

The malware can lead to credential and token theft for cloud and registry services, enabling unauthorized access and potential further compromise of software supply chains. It can propagate by compromising additional npm packages and GitHub repositories, increasing the attack surface and risk of widespread infection.

No official patch or remediation is currently documented for this threat. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance. Users should avoid using the affected versions 1.8.4 and 1.8.5 of @forjacms/sections-react. Consider auditing dependencies and monitoring for unusual account activity related to npm and GitHub. Removal of the affected package versions from projects is recommended until a fix or official guidance is available.