Threats Tagged 'mal-2026-5267'

The npm package 'wrangler-deploy' version 1.5.5 is identified as malicious code that mimics Cloudflare's official 'wrangler' CLI, potentially causing confusion among developers. The package contains minified code with patterns consistent with HTTP requests to Cloudflare APIs and base64 token handling, raising suspicion of credential exfiltration. It is linked to the Miasma malware, a self-propagating worm that spreads via weaponized 'binding.gyp' files during package installation, bypassing typical security inspections. The malware attempts to steal credentials and OIDC tokens for cloud and registry services and propagates by compromising other packages or repositories. No specific exploit or attacker-controlled endpoint has been conclusively identified yet.