Threats Tagged 'mal-2026-5255'

The npm package executable-stories-mcp version 0.3.3 contains potentially malicious code involving a bundled HTTP server module that uses child_process and HTTP methods with suspicious patterns. The package is associated with the Miasma malware, a self-propagating worm that spreads via weaponized binding.gyp files during package installation, bypassing typical security inspections. This malware attempts to exfiltrate credentials and OIDC tokens and propagates by compromising other packages and repositories. The exact malicious behavior in [email protected] is under human review, with no confirmed exploit details yet.