# AsyncAPI npm Supply-Chain Compromise via GitHub Actions Pwn Request Deploys 'M-Red-Team v6.4' / Miasma-Derived Multi-Stage Malware

> Attackers exploited an unmerged, known 'pwn request' misconfiguration in the AsyncAPI Generator repository's pull_request_target workflow to steal a maintainer's GitHub token, then published five malicious versions across four @asyncapi npm packages (combined ~140,000 downloads/day). The payload is a three-stage, 92,000-line malware framework self-identified as 'M-Red-Team v6.4' bearing Miasma-framework characteristics, using HTTP, Ethereum smart-contract, Nostr, libp2p, and IPFS channels for command and control and credential exfiltration.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1299
- **ID:** TL-2026-1299
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-14 at 05:08 UTC, an attacker opened pull request #2155 against asyncapi/generator, embedding an obfuscated JavaScript payload after roughly 1,000 bytes of whitespace to evade casual code review. The PR triggered the repository's `.github/workflows/manual-netlify-preview.yml` workflow, which uses the `pull_request_target` event and checks out the head of unreviewed fork pull requests while retaining access to base-repository secrets and the workflow's GITHUB_TOKEN -- a 'pwn request' misconfiguration that had already been reported in PR #2078 (April 2026) with an unmerged fix in PR #2092. By 05:16 UTC the workflow completed and a maintainer credential (GitHub Personal Access Token) was exfiltrated. The attacker used the stolen token to push a malicious commit to the `next` branch at 06:58 UTC, and at 07:10 UTC published three trojanized packages to npm. Between 07:51 and 08:28 UTC the attacker made additional commits to the related spec-json-schemas repository and published two further malicious package versions, bringing the total to five malicious releases across four @asyncapi-namespaced packages with a combined ~140,000 downloads/day.

The injected payload is a three-stage infection chain. Stage 1 executes on package import and spawns a detached process that writes a loader (`sync.js`) to a platform-specific hidden directory (Linux: `~/.local/share/NodeJS/`, macOS: `~/Library/Application Support/NodeJS/`, Windows: `%LOCALAPPDATA%\NodeJS\`) and downloads Stage 2 from IPFS. Stage 2 is an 8.25 MB encrypted bundle containing configuration and the main runtime. Stage 3 is a 92,000-line modular command-and-control framework that self-identifies internally as 'M-Red-Team v6.4' and exhibits code-level characteristics consistent with the previously documented 'Miasma' npm supply-chain malware family (the RedHat/@redhat-cloud-services npm compromise of 2026-06-01). Despite the 'red-team' branding in its self-identification string, this is a genuine credential-stealing supply-chain compromise, not an authorized red-team exercise.

The framework establishes persistence via a systemd user service (`miasma-monitor.service`) on Linux, registry modifications on Windows, and launch agents on macOS. Its capability set includes theft of browser-stored passwords and cookies (Chrome, Brave, Firefox, Edge), SSH private keys, npm and GitHub authentication tokens, AWS credentials, macOS Keychain contents, and cryptocurrency wallet data, plus remote file operations, directory listing, and arbitrary data exfiltration. For command and control the malware maintains multiple independent, redundant channels: a direct HTTP C2 server, two Ethereum smart contracts used as fallback/backup C2 beacon registries plus a third contract functioning as the operator's deployer wallet, Nostr relay messages tagged with Miasma-branded identifiers, a libp2p peer-to-peer mesh, and IPFS content-addressed storage for payload and configuration retrieval. Stolen tokens are additionally staged to a rentry.co paste as a dead drop. No definitive threat-actor attribution has been established; researchers note the payload mixes Miasma-framework code characteristics with naming conventions previously associated with a separate 'prt-scan' campaign.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1588 Obtain Capabilities
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1102 Web Service
- T1104 Multi-Stage Channels
- T1008 Fallback Channels
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions](https://www.wiz.io/blog/m-red-team-asyncapi-supply-chain-compromise-via-github-actions)
- [GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns](https://thehackernews.com/2026/06/github-updates-actionscheckout-to-block.html)
- [Safer pull_request_target defaults for GitHub Actions checkout](https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/)
- [Miasma: Supply Chain Attack Targeting RedHat npm Packages](https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages)
- [Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign](https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/)
- [600,000 Monthly Downloads Affected: Miasma Supply Chain Attack Is Back on npm](https://www.ox.security/blog/600000-monthly-downloads-affected-miasma-supply-chain-attack-is-back-on-npm/)
- [Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp](https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1299