Threats Tagged 'mal-2026-5215'

The autotel-backends npm package version 2.12.26 contains malicious code known as the Miasma malware. This malware is a self-propagating worm that exploits weaponized binding.gyp files to execute code during package installation, bypassing typical security inspections. It attempts to exfiltrate credentials and OIDC tokens for cloud and registry services and spreads by compromising other packages or repositories. Any system with this package installed should be considered fully compromised, and secrets must be rotated immediately. Removing the package alone may not eliminate all malicious components.