AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn Request Deploys 'M-Red-Team v6.4' / Miasma-Derived Multi-Stage Malware
AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn (TL-2026-1299), also tracked as M-Red-Team v6.4, is a critical-severity supply-chain compromise, first published 2026-07-14. It has no confirmed attribution, affects AsyncAPI Initiative @asyncapi/generator, maps to 22 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-1299
- Threat ID
- TL-2026-1299
- Also known as
- M-Red-Team v6.4, AsyncAPI Generator Supply-Chain Compromise
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-14
- Last reviewed
- 2026-07-14
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, open-source-ecosystem
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn
Malware and tooling: M-Red-Team v6.4, Miasma
Attackers exploited an unmerged, known 'pwn request' misconfiguration in the AsyncAPI Generator repository's pull_request_target workflow to steal a maintainer's GitHub token, then published five malicious versions across four @asyncapi npm packages (combined ~140,000 downloads/day). The payload is a three-stage, 92,000-line malware framework self-identified as 'M-Red-Team v6.4' bearing Miasma-framework characteristics, using HTTP, Ethereum smart-contract, Nostr, libp2p, and IPFS channels for command and control and credential exfiltration.
How AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn works
On 2026-07-14 at 05:08 UTC, an attacker opened pull request #2155 against asyncapi/generator, embedding an obfuscated JavaScript payload after roughly 1,000 bytes of whitespace to evade casual code review. The PR triggered the repository's `.github/workflows/manual-netlify-preview.yml` workflow, which uses the `pull_request_target` event and checks out the head of unreviewed fork pull requests while retaining access to base-repository secrets and the workflow's GITHUB_TOKEN -- a 'pwn request' misconfiguration that had already been reported in PR #2078 (April 2026) with an unmerged fix in PR #2092. By 05:16 UTC the workflow completed and a maintainer credential (GitHub Personal Access Token) was exfiltrated. The attacker used the stolen token to push a malicious commit to the `next` branch at 06:58 UTC, and at 07:10 UTC published three trojanized packages to npm. Between 07:51 and 08:28 UTC the attacker made additional commits to the related spec-json-schemas repository and published two further malicious package versions, bringing the total to five malicious releases across four @asyncapi-namespaced packages with a combined ~140,000 downloads/day.
The injected payload is a three-stage infection chain. Stage 1 executes on package import and spawns a detached process that writes a loader (`sync.js`) to a platform-specific hidden directory (Linux: `~/.local/share/NodeJS/`, macOS: `~/Library/Application Support/NodeJS/`, Windows: `%LOCALAPPDATA%\NodeJS\`) and downloads Stage 2 from IPFS. Stage 2 is an 8.25 MB encrypted bundle containing configuration and the main runtime. Stage 3 is a 92,000-line modular command-and-control framework that self-identifies internally as 'M-Red-Team v6.4' and exhibits code-level characteristics consistent with the previously documented 'Miasma' npm supply-chain malware family (the RedHat/@redhat-cloud-services npm compromise of 2026-06-01). Despite the 'red-team' branding in its self-identification string, this is a genuine credential-stealing supply-chain compromise, not an authorized red-team exercise.
The framework establishes persistence via a systemd user service (`miasma-monitor.service`) on Linux, registry modifications on Windows, and launch agents on macOS. Its capability set includes theft of browser-stored passwords and cookies (Chrome, Brave, Firefox, Edge), SSH private keys, npm and GitHub authentication tokens, AWS credentials, macOS Keychain contents, and cryptocurrency wallet data, plus remote file operations, directory listing, and arbitrary data exfiltration. For command and control the malware maintains multiple independent, redundant channels: a direct HTTP C2 server, two Ethereum smart contracts used as fallback/backup C2 beacon registries plus a third contract functioning as the operator's deployer wallet, Nostr relay messages tagged with Miasma-branded identifiers, a libp2p peer-to-peer mesh, and IPFS content-addressed storage for payload and configuration retrieval. Stolen tokens are additionally staged to a rentry.co paste as a dead drop. No definitive threat-actor attribution has been established; researchers note the payload mixes Miasma-framework code characteristics with naming conventions previously associated with a separate 'prt-scan' campaign.
MITRE ATT&CK techniques used in TL-2026-1299
Collection
Command and Control
T1008 Fallback Channels; T1071 Application Layer Protocol; T1102 Web Service; T1104 Multi-Stage Channels
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Discovery
T1083 File and Directory Discovery
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Persistence
T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Privilege Escalation
T1543 Create or Modify System Process
Resource Development
Reconnaissance
Affected products and versions in AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn
- AsyncAPI Initiative — @asyncapi/generator
Vulnerable versions: 3.3.1
Fixed in: unpublished/removed by npm and maintainers post-disclosure - AsyncAPI Initiative — @asyncapi/generator-helpers
Vulnerable versions: 1.1.1
Fixed in: unpublished/removed by npm and maintainers post-disclosure - AsyncAPI Initiative — @asyncapi/generator-components
Vulnerable versions: 0.7.1
Fixed in: unpublished/removed by npm and maintainers post-disclosure - AsyncAPI Initiative — @asyncapi/specs
Vulnerable versions: 6.11.2; 6.11.2-alpha.1
Fixed in: unpublished/removed by npm and maintainers post-disclosure - GitHub — GitHub Actions (pull_request_target trigger)
Vulnerable versions: actions/checkout < v7 default behavior
Fixed in: actions/checkout v7+ (blocks common pwn-request patterns by default)
Remediation for AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn
Patches
- Merge the previously proposed fix in asyncapi/generator PR #2092 to remove or scope the pull_request_target trigger in manual-netlify-preview.yml
- Upgrade actions/checkout to v7+ which blocks common pwn-request checkout patterns by default
Immediate actions
- Remove @asyncapi/generator 3.3.1, @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, and @asyncapi/specs 6.11.2 / 6.11.2-alpha.1 from all dependency trees and lockfiles immediately
- Rotate all GitHub Personal Access Tokens, SSH keys, npm auth tokens, AWS credentials, and CI/CD secrets accessible to any host that installed the affected package versions
- Hunt for the systemd unit miasma-monitor.service (Linux), unexpected registry run-key entries (Windows), and unrecognized launch agents (macOS)
- Block outbound traffic to 85.137.53.71 (ports 8080/8081) and the listed IPFS/rentry.co indicators at the network perimeter
- Audit browser credential stores, macOS Keychain, and cryptocurrency wallet files on any affected developer workstation or CI runner
Workarounds
- Disable or gate the manual-netlify-preview.yml workflow pending a secure rewrite
- Require manual maintainer approval before any pull_request_target workflow executes for external contributors
Longer-term hardening
- Deploy EDR/behavioral detection on developer workstations and CI/CD runners capable of alerting on child processes spawned from node_modules during npm install
- Adopt SBOM generation and continuous dependency provenance verification for all npm packages pulled into build pipelines
- Implement dependency allowlisting / package pinning with cryptographic lockfile verification for CI/CD environments
Weaknesses (CWE) in AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn
CWE-829, CWE-494, CWE-522
Timeline of AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn
- PR #2078 identifies the unsafe pull_request_target configuration in asyncapi/generator's manual-netlify-preview.yml workflow
- PR #2092 proposes a fix for the pwn-request vulnerability but remains unmerged
- Wiz Research publishes analysis identifying the 'M-Red-Team v6.4' malware framework and its Miasma-derived characteristics
- 07:51-08:28 UTC - Additional malicious commits pushed to spec-json-schemas repository; two more malicious package versions published, bringing total to five malicious releases
- 07:10 UTC - Three trojanized npm packages published under the @asyncapi namespace
- 06:58 UTC - Attacker uses stolen token to push malicious commit to the asyncapi/generator 'next' branch
- 05:16 UTC - Vulnerable pull_request_target workflow completes; maintainer GitHub PAT is exfiltrated
- 05:08 UTC - Attacker opens PR #2155 containing obfuscated JavaScript payload hidden after ~1,000 bytes of whitespace
Sources cited for AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn
- M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions
- GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns
- Safer pull_request_target defaults for GitHub Actions checkout
- Miasma: Supply Chain Attack Targeting RedHat npm Packages
- Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
- 600,000 Monthly Downloads Affected: Miasma Supply Chain Attack Is Back on npm
- Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp
Threats related to AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn
- AsyncAPI npm Supply Chain Compromise: GitHub Actions pull_request_target Exploit Deploys Miasma RAT to Packages with 2.9M Weekly Downloads
- AsyncAPI npm Supply Chain Compromise: Import-Time Payload Delivery via Miasma Loader
- npm Supply-Chain Attack on @asyncapi Packages Deploys Miasma Botnet via IPFS-Hosted Second-Stage Payload
- AsyncAPI npm Supply Chain Attack: Pwn-Request GitHub Actions Compromise Deploys Miasma Tasking Framework
- ViteVenom: Blockchain-C2 npm Supply Chain Malware Targets Vite Ecosystem (Sequel to ChainVeil, PolinRider Cluster)
- GitHub Internal Breach — TeamPCP Exfiltrates 3,800+ Repos via Poisoned VS Code Extension Tied to Mini Shai-Hulud Worm
Detection coverage for TL-2026-1299
As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1299 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1299
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.