The github-archiver npm package contains malicious code identified as Miasma malware, which executes during installation by exploiting binding.gyp files to evade lifecycle script inspections. Once executed, it exfiltrates credentials and OIDC tokens for various cloud and registry services. The malware propagates by compromising other npm packages managed by stolen accounts or by committing backdoor files to GitHub repositories. Any system with this package installed is considered fully compromised, necessitating immediate secret rotation and package removal. However, removal alone may not eliminate all malicious artifacts due to potential full system compromise.

Systems with the affected versions of github-archiver installed are fully compromised. The malware can steal sensitive credentials and tokens, enabling unauthorized access to cloud and registry services. It also self-propagates by compromising other packages and repositories, increasing the attack surface and persistence. This can lead to widespread credential theft, unauthorized code injection, and potential long-term compromise of development environments.

There is no official patch or fix available for this malicious package. Immediate removal of the github-archiver package from affected systems is required. All secrets, keys, and tokens stored on compromised machines must be rotated from a secure, unaffected device. Due to the potential full compromise of the system, consider rebuilding or thoroughly cleaning affected environments. Monitor for any signs of persistence or backdoors introduced by the malware. Check vendor advisories and npm security resources for any updates or remediation guidance.