The autotel-cloudflare npm package version 2.18.16 contains malicious code known as the Miasma malware. This malware executes during package installation by abusing weaponized binding.gyp files, bypassing typical security inspections. It attempts to exfiltrate credentials and OIDC tokens for cloud and registry services and propagates by compromising other packages and GitHub repositories. Any system with this package installed should be considered fully compromised, and secrets must be rotated immediately.