npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma Botnet via IPFS-Hosted Second-Stage Payload — Threadlinqs Intelligence
As of 2026-07-14, npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma Botnet via IPFS-Hosted Second-Stage Payload is a high-severity supply chain threat attributed to Miasma npm worm operators, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 40 indicators of compromise.
Threat ID: TL-2026-1293 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Miasma npm worm operators · FINANCIAL
Three packages in the @asyncapi npm namespace (generator-helpers 1.1.1, generator-components 0.7.1, generator 3.3.1) were trojanized with an obfuscated payload hidden in src/utils.js that
On 2026-07-14, Socket Research Team disclosed that three npm packages in the @asyncapi namespace — @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, and @asyncapi/generator@3.3.1 — were compromised to embed a malicious loader inside src/utils.js, concealed behind a large block of leading whitespace between legitimate functions. The loader auto-executes the moment the package is imported/required (no separate install-time lifecycle hook is required) and spawns a detached Node.js child process. That process downloads an AES-encrypted second-stage payload hosted on IPFS (ipfs.io gateway, CID QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9) and writes it to disk as sync.js under platform-specific application-data directories (macOS: ~/Library/Application Support/NodeJS/sync.js; Linux: ~/.local/share/NodeJS/sync.js; Windows: %LOCALAPPDATA%\NodeJS\sync.js), giving the implant durable presence independent of the originating package. The decrypted payload establishes command-and-control with a hardcoded IP (85.137.53.71) and deploys the Miasma botnet framework, which Socket describes as supporting shell command execution, file operations, credential harvesting, evasion checks, persistence, and multi-protocol command and control.
This incident sits inside the broader 'Miasma' / Shai-Hulud-lineage npm worm campaign active since at least June 2026. Earlier waves compromised 32 packages (90+ versions) in the @redhat-cloud-services namespace on 2026-06-01 using a 4.29 MB obfuscated preinstall-hook dropper (Microsoft, JFrog), followed on 2026-06-03 at 23:30 UTC by @vapi-ai/server-sdk (408,000+ monthly downloads; versions 0.11.1, 0.11.2, 1.2.1, 1.2.2) — the largest single victim of the 'Phantom Gyp' Miasma v2 wave. Roughly one hour later (2026-06-04, ~00:30 UTC) the worm escalated automatically, publishing malicious versions across 50+ packages from maintainer 'jagreehal' plus the autotel, awaitly, executable-stories, node-env-resolver, and wrangler-deploy package families, reaching 57 npm packages and 286+ malicious versions in under two hours. The 'Phantom Gyp' variant abuses a 157-byte binding.gyp file exploiting node-gyp's `<!(...)` command-substitution syntax to execute arbitrary shell commands and select the injected source file at npm-install time — without declaring any lifecycle script, bypassing tools that only monitor package.json scripts.
StepSecurity's deep technical analysis documents a four-stage obfuscation chain used by this wave: (1) a ROT-N Caesar cipher with five distinct rotation values observed across packages (ROT-9, ROT-15, ROT-18, ROT-19, ROT-20); (2) AES-128-GCM decryption of two hex-encoded blobs with embedded keys; (3) a Bun runtime loader that silently downloads a standalone Bun v1.3.13 binary (via github.com/oven-sh/bun releases, staged under /tmp/b-* using a spoofed 'python-requests/2.31.0' User-Agent) specifically to evade Node.js-focused monitoring tooling; and (4) a main payload obfuscated with Obfuscator.io containing a 2,306-entry encrypted string table. The malware targets cloud and developer credentials broadly: AWS (IMDSv2 instance metadata, Secrets Manager), GCP (service accounts, Cloud Secret Manager), Azure (managed identities, Key Vault), HashiCorp Vault, GitHub Actions (OIDC tokens, and runner memory scraping via /proc/[pid]/mem), and local password managers (1Password, gopass, pass). It also injects backdoor files into victim repositories targeting AI coding assistants — .claude/setup.mjs (Claude), .cursor/rules/setup.mdc (Cursor), .gemini/settings.json (Gemini), and a .vscode/tasks.json entry with runOn: folderOpen — to gain execution the next time a developer opens the poisoned repo in an AI-assisted editor. Exfiltration and C2 activity center on the GitHub account github.com/liuende501 (236 repositories at time of analysis), using mythology-themed (e.g., nemean-hydra-34343) and Dune-themed repo names, 34 of which are labeled 'Miasma - The Spreading Blight' and 195 of whi
Weaknesses (CWE)
CWE-506, CWE-494
Target sectors: technology, software-development, cloud-services
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 40 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1195.002, T1059.007, T1204.002, T1129, T1059.004, T1027, T1027.010, T1140, T1036, T1553