# npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma Botnet via IPFS-Hosted Second-Stage Payload

> Three packages in the @asyncapi npm namespace (generator-helpers 1.1.1, generator-components 0.7.1, generator 3.3.1) were trojanized with an obfuscated payload hidden in src/utils.js that auto-executes on import, fetches an encrypted second-stage script from IPFS, persists on disk as sync.js, and beacons to a hardcoded C2 IP to deploy the Miasma botnet framework, which supports shell execution, file operations, credential harvesting, evasion checks, persistence, and multi-protocol C2.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1293
- **ID:** TL-2026-1293
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** Miasma npm worm operators
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-14, Socket Research Team disclosed that three npm packages in the @asyncapi namespace — @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, and @asyncapi/generator@3.3.1 — were compromised to embed a malicious loader inside src/utils.js, concealed behind a large block of leading whitespace between legitimate functions. The loader auto-executes the moment the package is imported/required (no separate install-time lifecycle hook is required) and spawns a detached Node.js child process. That process downloads an AES-encrypted second-stage payload hosted on IPFS (ipfs.io gateway, CID QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9) and writes it to disk as sync.js under platform-specific application-data directories (macOS: ~/Library/Application Support/NodeJS/sync.js; Linux: ~/.local/share/NodeJS/sync.js; Windows: %LOCALAPPDATA%\NodeJS\sync.js), giving the implant durable presence independent of the originating package. The decrypted payload establishes command-and-control with a hardcoded IP (85.137.53.71) and deploys the Miasma botnet framework, which Socket describes as supporting shell command execution, file operations, credential harvesting, evasion checks, persistence, and multi-protocol command and control.

This incident sits inside the broader 'Miasma' / Shai-Hulud-lineage npm worm campaign active since at least June 2026. Earlier waves compromised 32 packages (90+ versions) in the @redhat-cloud-services namespace on 2026-06-01 using a 4.29 MB obfuscated preinstall-hook dropper (Microsoft, JFrog), followed on 2026-06-03 at 23:30 UTC by @vapi-ai/server-sdk (408,000+ monthly downloads; versions 0.11.1, 0.11.2, 1.2.1, 1.2.2) — the largest single victim of the 'Phantom Gyp' Miasma v2 wave. Roughly one hour later (2026-06-04, ~00:30 UTC) the worm escalated automatically, publishing malicious versions across 50+ packages from maintainer 'jagreehal' plus the autotel, awaitly, executable-stories, node-env-resolver, and wrangler-deploy package families, reaching 57 npm packages and 286+ malicious versions in under two hours. The 'Phantom Gyp' variant abuses a 157-byte binding.gyp file exploiting node-gyp's `<!(...)` command-substitution syntax to execute arbitrary shell commands and select the injected source file at npm-install time — without declaring any lifecycle script, bypassing tools that only monitor package.json scripts.

StepSecurity's deep technical analysis documents a four-stage obfuscation chain used by this wave: (1) a ROT-N Caesar cipher with five distinct rotation values observed across packages (ROT-9, ROT-15, ROT-18, ROT-19, ROT-20); (2) AES-128-GCM decryption of two hex-encoded blobs with embedded keys; (3) a Bun runtime loader that silently downloads a standalone Bun v1.3.13 binary (via github.com/oven-sh/bun releases, staged under /tmp/b-* using a spoofed 'python-requests/2.31.0' User-Agent) specifically to evade Node.js-focused monitoring tooling; and (4) a main payload obfuscated with Obfuscator.io containing a 2,306-entry encrypted string table. The malware targets cloud and developer credentials broadly: AWS (IMDSv2 instance metadata, Secrets Manager), GCP (service accounts, Cloud Secret Manager), Azure (managed identities, Key Vault), HashiCorp Vault, GitHub Actions (OIDC tokens, and runner memory scraping via /proc/[pid]/mem), and local password managers (1Password, gopass, pass). It also injects backdoor files into victim repositories targeting AI coding assistants — .claude/setup.mjs (Claude), .cursor/rules/setup.mdc (Cursor), .gemini/settings.json (Gemini), and a .vscode/tasks.json entry with runOn: folderOpen — to gain execution the next time a developer opens the poisoned repo in an AI-assisted editor. Exfiltration and C2 activity center on the GitHub account github.com/liuende501 (236 repositories at time of analysis), using mythology-themed (e.g., nemean-hydra-34343) and Dune-themed repo names, 34 of which are labeled 'Miasma - The Spreading Blight' and 195 of which contain a reversed string reading 'Shai-Hulud: Here We Go Again' — a taunt referencing prior StepSecurity research on the lineage. C2 beaconing and control use a magic-keyword GitHub search string ('thebeautifulmarchoftime') and a token-validation phrase ('IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner') gating a destructive dead-man's-switch. The worm additionally propagates cross-ecosystem: on npm it forges Sigstore provenance attestations via Fulcio/Rekor to appear verified/trusted, on RubyGems it injects payloads into extconf.rb build scripts, and on GitHub it uses stolen tokens to backdoor additional repositories.

The campaign is treated by researchers as a continuation of the Shai-Hulud malware family ('Here We Go Again' → 'Miasma: The Spreading Blight' → 'Hades' on PyPI), and is attributed in threat-intel writeups to tactics consistent with TeamPCP (aka Replicating Marauder), the group that open-sourced the original Shai-Hulud tooling. Notably, @asyncapi/generator-helpers was also caught up in a separate, earlier Shai-Hulud wave in November 2025, making the @asyncapi namespace a repeat target for this malware lineage. This July 2026 incident diverges from the GitHub-repo-as-C2 and Anthropic-API-camouflage exfiltration channels seen in the Red Hat and binding.gyp waves by instead using IPFS for payload delivery and a hardcoded IP for C2 — indicating active tooling evolution within the same actor/family rather than a static toolkit.

Downstream impact is significant: @asyncapi/generator and its helper packages are widely used in the AsyncAPI code-generation tooling ecosystem, meaning any CI pipeline, developer workstation, or automated build that imports the compromised versions is at risk of automatic, silent compromise with no user interaction beyond a routine `npm install`.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1129 Shared Modules
- T1059.004 Unix Shell
- T1027 Obfuscated Files or Information
- T1027.010 Command Obfuscation
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1547 Boot or Logon Autostart Execution
- T1098 Account Manipulation
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1555 Credentials from Password Stores
- T1552.001 Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1485 Data Destruction

## Sources

- [AsyncAPI Supply Chain Attack](https://socket.dev/blog/asyncapi-supply-chain-attack)
- [Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack](https://thehackernews.com/2026/06/miasma-malware-targets-npm-packages-and.html)
- [Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm](https://thehackernews.com/2026/06/miasma-supply-chain-attack-compromises.html)
- [Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign](https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/)
- [Shai-Hulud - Miasma: The Spreading Blight Hits Red Hat npm Packages](https://research.jfrog.com/post/shai-hulud-miasma-redhat-cloud-services/)
- [Miasma v2: Self-Spreading npm Worm Now Uses Malicious binding.gyp file and Compromises 57 Packages](https://semgrep.dev/blog/2026/miasma-v2-self-spreading-npm-worm-now-uses-malicious-bindinggyp-file-and-compromises-57-packages/)
- [Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp](https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm)
- [Miasma: Supply Chain Attack Targeting RedHat npm Packages](https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages)
- [Embedded Malicious Code in @asyncapi/generator](https://security.snyk.io/vuln/SNYK-JS-ASYNCAPIGENERATOR-14103255)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1293