npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma Botnet via IPFS-Hosted Second-Stage Payload
npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma (TL-2026-1293), also tracked as Miasma: The Spreading Blight, is a high-severity supply-chain compromise, first published 2026-07-14. It is attributed to Miasma npm worm operators with low confidence, affects AsyncAPI Initiative @asyncapi/generator-helpers, maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1027.010), and is covered by 9 detection rules and 40 indicators of compromise.
Key facts for TL-2026-1293
- Threat ID
- TL-2026-1293
- Also known as
- Miasma: The Spreading Blight, AsyncAPI Supply Chain Attack, Phantom Gyp
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-14
- Last reviewed
- 2026-07-14
- Attribution
- Miasma npm worm operators
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cloud-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 40
Malware and tooling in npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma
Malware and tooling: Miasma, Shai-Hulud, Bun v1.3.13 (standalone runtime loader), Obfuscator.io
Three packages in the @asyncapi npm namespace (generator-helpers 1.1.1, generator-components 0.7.1, generator 3.3.1) were trojanized with an obfuscated payload hidden in src/utils.js that auto-executes on import, fetches an encrypted second-stage script from IPFS, persists on disk as sync.js, and beacons to a hardcoded C2 IP to deploy the Miasma botnet framework, which supports shell execution, file operations, credential harvesting, evasion checks, persistence, and multi-protocol C2.
How npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma works
On 2026-07-14, Socket Research Team disclosed that three npm packages in the @asyncapi namespace — @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, and @asyncapi/generator@3.3.1 — were compromised to embed a malicious loader inside src/utils.js, concealed behind a large block of leading whitespace between legitimate functions. The loader auto-executes the moment the package is imported/required (no separate install-time lifecycle hook is required) and spawns a detached Node.js child process. That process downloads an AES-encrypted second-stage payload hosted on IPFS (ipfs.io gateway, CID QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9) and writes it to disk as sync.js under platform-specific application-data directories (macOS: ~/Library/Application Support/NodeJS/sync.js; Linux: ~/.local/share/NodeJS/sync.js; Windows: %LOCALAPPDATA%\NodeJS\sync.js), giving the implant durable presence independent of the originating package. The decrypted payload establishes command-and-control with a hardcoded IP (85.137.53.71) and deploys the Miasma botnet framework, which Socket describes as supporting shell command execution, file operations, credential harvesting, evasion checks, persistence, and multi-protocol command and control.
This incident sits inside the broader 'Miasma' / Shai-Hulud-lineage npm worm campaign active since at least June 2026. Earlier waves compromised 32 packages (90+ versions) in the @redhat-cloud-services namespace on 2026-06-01 using a 4.29 MB obfuscated preinstall-hook dropper (Microsoft, JFrog), followed on 2026-06-03 at 23:30 UTC by @vapi-ai/server-sdk (408,000+ monthly downloads; versions 0.11.1, 0.11.2, 1.2.1, 1.2.2) — the largest single victim of the 'Phantom Gyp' Miasma v2 wave. Roughly one hour later (2026-06-04, ~00:30 UTC) the worm escalated automatically, publishing malicious versions across 50+ packages from maintainer 'jagreehal' plus the autotel, awaitly, executable-stories, node-env-resolver, and wrangler-deploy package families, reaching 57 npm packages and 286+ malicious versions in under two hours. The 'Phantom Gyp' variant abuses a 157-byte binding.gyp file exploiting node-gyp's `<!(...)` command-substitution syntax to execute arbitrary shell commands and select the injected source file at npm-install time — without declaring any lifecycle script, bypassing tools that only monitor package.json scripts.
StepSecurity's deep technical analysis documents a four-stage obfuscation chain used by this wave: (1) a ROT-N Caesar cipher with five distinct rotation values observed across packages (ROT-9, ROT-15, ROT-18, ROT-19, ROT-20); (2) AES-128-GCM decryption of two hex-encoded blobs with embedded keys; (3) a Bun runtime loader that silently downloads a standalone Bun v1.3.13 binary (via github.com/oven-sh/bun releases, staged under /tmp/b-* using a spoofed 'python-requests/2.31.0' User-Agent) specifically to evade Node.js-focused monitoring tooling; and (4) a main payload obfuscated with Obfuscator.io containing a 2,306-entry encrypted string table. The malware targets cloud and developer credentials broadly: AWS (IMDSv2 instance metadata, Secrets Manager), GCP (service accounts, Cloud Secret Manager), Azure (managed identities, Key Vault), HashiCorp Vault, GitHub Actions (OIDC tokens, and runner memory scraping via /proc/[pid]/mem), and local password managers (1Password, gopass, pass). It also injects backdoor files into victim repositories targeting AI coding assistants — .claude/setup.mjs (Claude), .cursor/rules/setup.mdc (Cursor), .gemini/settings.json (Gemini), and a .vscode/tasks.json entry with runOn: folderOpen — to gain execution the next time a developer opens the poisoned repo in an AI-assisted editor. Exfiltration and C2 activity center on the GitHub account github.com/liuende501 (236 repositories at time of analysis), using mythology-themed (e.g., nemean-hydra-34343) and Dune-themed repo names, 34 of which are labeled 'Miasma - The Spreading Blight' and 195 of which contain a reversed string reading 'Shai-Hulud: Here We Go Again' — a taunt referencing prior StepSecurity research on the lineage. C2 beaconing and control use a magic-keyword GitHub search string ('thebeautifulmarchoftime') and a token-validation phrase ('IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner') gating a destructive dead-man's-switch. The worm additionally propagates cross-ecosystem: on npm it forges Sigstore provenance attestations via Fulcio/Rekor to appear verified/trusted, on RubyGems it injects payloads into extconf.rb build scripts, and on GitHub it uses stolen tokens to backdoor additional repositories.
The campaign is treated by researchers as a continuation of the Shai-Hulud malware family ('Here We Go Again' → 'Miasma: The Spreading Blight' → 'Hades' on PyPI), and is attributed in threat-intel writeups to tactics consistent with TeamPCP (aka Replicating Marauder), the group that open-sourced the original Shai-Hulud tooling. Notably, @asyncapi/generator-helpers was also caught up in a separate, earlier Shai-Hulud wave in November 2025, making the @asyncapi namespace a repeat target for this malware lineage. This July 2026 incident diverges from the GitHub-repo-as-C2 and Anthropic-API-camouflage exfiltration channels seen in the Red Hat and binding.gyp waves by instead using IPFS for payload delivery and a hardcoded IP for C2 — indicating active tooling evolution within the same actor/family rather than a static toolkit.
Downstream impact is significant: @asyncapi/generator and its helper packages are widely used in the AsyncAPI code-generation tooling ecosystem, meaning any CI pipeline, developer workstation, or automated build that imports the compromised versions is at risk of automatic, silent compromise with no user interaction beyond a routine `npm install`.
MITRE ATT&CK techniques used in TL-2026-1293
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1027.010 Command Obfuscation; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Execution
T1059.004 Unix Shell; T1059.007 JavaScript; T1129 Shared Modules; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
Persistence
T1098 Account Manipulation; T1547 Boot or Logon Autostart Execution
Initial Access
T1195.002 Compromise Software Supply Chain
Impact
Credential Access
T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API; T1555 Credentials from Password Stores
defense-impairment
Affected products and versions in npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma
- AsyncAPI Initiative — @asyncapi/generator-helpers
Vulnerable versions: 1.1.1 - AsyncAPI Initiative — @asyncapi/generator-components
Vulnerable versions: 0.7.1 - AsyncAPI Initiative — @asyncapi/generator
Vulnerable versions: 3.3.1 - Vapi — @vapi-ai/server-sdk
Vulnerable versions: 0.11.1; 0.11.2; 1.2.1; 1.2.2
Remediation for npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma
Patches
- No fixed/patched versions of the three affected @asyncapi packages had been published or confirmed by the source at time of disclosure (2026-07-14); treat the flagged versions as permanently compromised until vendor confirmation
Immediate actions
- Remove or pin away from @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, and @asyncapi/generator 3.3.1 in all package.json/lockfiles
- Audit all systems that ran `npm install`/`npm ci` against these versions for the presence of sync.js under the platform-specific NodeJS application-data directories
- Block outbound connections to 85.137.53.71 and monitor/alert on requests to ipfs.io from build and developer systems
- Kill any detached Node.js child processes spawned during package install/import that were not part of the expected build graph
- Rotate all credentials (npm tokens, GitHub tokens/Actions OIDC secrets, cloud IAM/OAuth tokens, SSH keys, browser-stored secrets, HashiCorp Vault tokens) on any host or CI runner that imported the compromised versions
- Search repositories for injected AI-assistant backdoor files: .claude/setup.mjs, .cursor/rules/setup.mdc, .gemini/settings.json, and .vscode/tasks.json entries with runOn: folderOpen
- Audit for unexpected binding.gyp files containing `<!(...)` command-substitution syntax across the dependency tree, not just preinstall/postinstall scripts
Workarounds
- Pin @asyncapi packages to known-good versions predating 1.1.1 (generator-helpers), 0.7.1 (generator-components), and 3.3.1 (generator) until a clean release is confirmed
- Run npm installs for these packages only inside disposable, network-egress-restricted sandboxes during remediation
Longer-term hardening
- Deploy EDR/behavioral detection on developer workstations and CI runners capable of flagging Node.js processes spawning detached children, downloading standalone runtimes (e.g., Bun), and writing to user application-data directories at install/import time
- Adopt lockfile integrity enforcement (npm ci with registry provenance/SLSA verification) and block postinstall/preinstall or first-import network egress by default in CI
- Implement package allow-listing and automated diffing of dependency tree changes for high-value namespaces like @asyncapi
- Monitor for the broader Miasma/Shai-Hulud campaign markers (GitHub repos with descriptions such as 'Miasma: The Spreading Blight', mythology/Dune-themed repo names, unexpected preinstall scripts, binding.gyp with command-substitution syntax)
- Do not trust Sigstore/Fulcio/Rekor provenance attestations alone as proof of package integrity given documented forging in this campaign
- Extend supply-chain monitoring beyond npm to RubyGems (extconf.rb injection) given confirmed cross-ecosystem propagation
Weaknesses (CWE) in npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma
CWE-506, CWE-494
Timeline of npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma
- An earlier, separate Shai-Hulud npm worm wave compromises trojanized packages including @asyncapi/generator-helpers, marking the @asyncapi namespace as a repeat target for this malware lineage.
- The 'Miasma' npm worm campaign publicly surfaces after 32 packages (90+ versions) in the @redhat-cloud-services npm namespace are found trojanized via a 4.29 MB obfuscated preinstall-hook dropper.
- JFrog independently publishes its own research post on the Shai-Hulud/Miasma Red Hat npm compromise, corroborating Microsoft's findings on the campaign's techniques and scope.
- Microsoft publishes 'Preinstall to persistence', a detailed technical analysis of the Red Hat npm 'Miasma: The Spreading Blight' campaign, documenting credential-harvesting, persistence, and GitHub-repo-based C2/exfiltration.
- @vapi-ai/server-sdk (408,000+ monthly downloads), the largest single victim of the 'Phantom Gyp' Miasma v2 wave, is hit at 23:30 UTC, with malicious versions 0.11.1, 0.11.2, 1.2.1, and 1.2.2 published via a 157-byte malicious binding.gyp file that triggers code execution during npm install without declaring a lifecycle script.
- The fully automated Phantom Gyp propagation run completes, reaching 57 npm packages across 286+ malicious versions in under two hours total, with Semgrep and StepSecurity subsequently documenting the four-stage ROT-cipher/AES-128-GCM/Bun-loader/Obfuscator.io obfuscation chain and the github.com/liuende501 exfiltration account.
- Roughly one hour after the initial @vapi-ai/server-sdk compromise (~00:30 UTC), the Phantom Gyp/Miasma v2 worm escalates automatically: the attacker publishes malicious versions of 50+ packages belonging to maintainer 'jagreehal' plus dozens more across the autotel, awaitly, executable-stories, node-env-resolver, and wrangler-deploy package families.
- Socket.dev publishes the public disclosure blog 'AsyncAPI Supply Chain Attack', and Snyk publishes a corresponding vulnerability advisory (SNYK-JS-ASYNCAPIGENERATOR-14103255).
- Socket Research Team discovers that @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, and @asyncapi/generator 3.3.1 have been trojanized with an IPFS-delivered second-stage payload (sync.js) that beacons to 85.137.53.71 and deploys the Miasma botnet framework.
Sources cited for npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma
- AsyncAPI Supply Chain Attack
- Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
- Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
- Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
- Shai-Hulud - Miasma: The Spreading Blight Hits Red Hat npm Packages
- Miasma v2: Self-Spreading npm Worm Now Uses Malicious binding.gyp file and Compromises 57 Packages
- Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp
- Miasma: Supply Chain Attack Targeting RedHat npm Packages
- Embedded Malicious Code in @asyncapi/generator
Threats related to npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma
- AsyncAPI npm Supply Chain Attack: Pwn-Request GitHub Actions Compromise Deploys Miasma Tasking Framework
- AsyncAPI npm Supply Chain Compromise: Import-Time Payload Delivery via Miasma Loader
- AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn Request Deploys 'M-Red-Team v6.4' / Miasma-Derived Multi-Stage Malware
- AsyncAPI npm Supply Chain Compromise: GitHub Actions pull_request_target Exploit Deploys Miasma RAT to Packages with 2.9M Weekly Downloads
- Binding.gyp "Phantom Gyp" Supply Chain Attack (Miasma Worm) Enables CI/CD Worm Propagation Across 57 npm Packages
- Miasma Supply-Chain Malware Abuses binding.gyp "Phantom Gyp" Trick and Bun Runtime to Steal Developer Credentials Across npm, Go, and RubyGems
Detection coverage for TL-2026-1293
As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1293 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1293
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.