The dbmux npm package versions 1.0.5 and 2.2.5 contain malicious code known as the Miasma malware. This malware propagates by abusing binding.gyp files during package installation, evading detection by security tools that only inspect lifecycle scripts. It attempts to exfiltrate credentials and OIDC tokens for cloud and registry services, potentially compromising the host system and spreading to other packages and repositories. Systems with this package installed should be considered fully compromised.