On 2026-07-14 at 05:08 UTC, an unknown threat actor opened 37 pull requests against the asyncapi/generator GitHub repository, the majority of which were decoy PRs proposing a fake charity donation page. One PR (#2155) contained JavaScript obfuscated behind roughly 1,000 bytes of leading whitespace that exploited the repository's pull_request_target GitHub Actions trigger. This trigger type runs workflows with access to base-repository secrets even when the workflow checks out attacker-controlled pull request code -- a known "pwn request" anti-pattern. A remediation PR (#2078/#2092) flagging this exact misconfiguration had been open and unmerged for 58-77 days (proposed 2026-04-29/05-17) at the time of the breach. The malicious workflow run completed at 05:16 UTC, exfiltrating a highly privileged Personal Access Token belonging to the asyncapi-bot service account to a dead-drop paste on rentry.co. Using the stolen token, the attacker pushed a malicious commit (3eab3ec9304aa26081358330491d3cfeb55cc245) directly to the next branch at 06:58 UTC, triggering the release workflow. The first three trojanized packages published at 07:10 UTC, with two additional compromised versions following between 07:51 and 08:28 UTC.

Five versions across four @asyncapi npm packages were backdoored: @asyncapi/specs (6.11.2 and 6.11.2-alpha.1, the highest-traffic package at ~2.7M weekly downloads alone), @asyncapi/generator (3.3.1), @asyncapi/generator-helpers (1.1.1), and @asyncapi/generator-components (0.7.1). Unlike npm supply-chain attacks that rely on postinstall lifecycle scripts, the malicious code was embedded directly inside runtime modules using three distinct injection techniques: whitespace obfuscation (roughly 880 padding spaces concealing payload inside legitimate function closures), direct inline injection prepended to index.js, and hex-variable obfuscation with base64-encoded string arrays via javascript-obfuscator with a custom base64 alphabet. This design ensures the payload fires on a simple require()/import call rather than only during npm install, evading defenses that only monitor lifecycle-script execution.

On import, the injected loader (Stage 1) spawns a detached Node.js child process (surviving parent termination, hidden from the user) that fetches an 8.2-8.25MB encrypted bundle (Stage 2) from IPFS (CIDs Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf for the specs payload and QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9 for the generator-family payload), writing it to disk as sync.js under platform-specific per-user Node.js directories. The bundle is decrypted using ECDH + HKDF-SHA256 key derivation with AES-256-GCM (plus an ASCII rotation-reversal step), yielding Stage 3: a roughly 92,000-line modular RAT framework that self-identifies in runtime comments as "M-RED-TEAM v6.4" and internally as build target "miasma-train-p1". A hardcoded fallback master key ("rt-vault-master-key-32b-aaaaaaaa") was found in plaintext in the payload. The compiled payload build timestamp (2026-07-14 04:10 UTC) precedes the compromise by roughly three hours, indicating pre-staged tooling.

The deployed implant establishes persistence via systemd user service (Linux: ~/.config/systemd/user/miasma-monitor.service), shell rc-file injection with the marker "### Node Auto-Update Script ###" (macOS/Linux), and an HKCU Run-key registry entry (Windows), alongside a lock file (~/.config/.miasma/run/node.lock or ~/.config/miasma/runnode.lock) to prevent duplicate execution. It beacons via HTTP to 85.137.53.71:8080 approximately every 30 seconds using per-victim derived encryption keys and a custom header (X-Miasma-Spawn-Chain), with companion ports 8081 (upload/exfiltration) and 8091 (proxy management) on the same host (RIPE block 85.137.53.0/24, AS43641, Netherlands). Decentralized fallback channels include an Ethereum smart contract on mainnet (0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710), Nostr relays (wss://relay.damus.io, wss://relay.nostr.com/), BitTorrent DHT bootstrap nodes (router.bittorrent.com:6881, dht.transmissionbt.com:6881), plus IPFS, libp2p, and mDNS -- a seven-channel failover communications stack.

Active/enabled capabilities observed in the recovered build include a remote shell handler executing arbitrary commands via child_process.exec() (blacklisting only the literal string "killall"), file operations sandboxed to a /sim-fs path, system reconnaissance (PATH, HOME, USER, HOSTNAME), and payload update retrieval from Nostr/Ethereum sources. Analysts identified an extensive but largely DISABLED credential-harvesting module covering 300+ target file paths: AWS credentials (~/.aws/*), SSH/GPG keys, npm tokens (~/.npmrc), GitHub CLI config, Kubernetes/Docker registry auth, browser-saved passwords and cookies (Chrome, Brave, Firefox, Edge), macOS Keychain, cryptocurrency wallets (Bitcoin, Ethereum, Solana), AI-tool credentials (Claude/Anthropic, Cursor), and password managers (Bitwarden, 1Password, KeePassXC). Also present but toggled off: self-propagation modules targeting npm, PyPI, and Cargo; AI-developer-tool poisoning hooks (Claude, VS Code, Gemini, Cursor); a metamorphic self-modification/evasion engine; security-product sandbox-evasion checks (CrowdStrike, SentinelOne, Microsoft Defender, CarbonBlack, Cylance, Osquery, Tanium, Qualys); and a dead-man-switch that would wipe local directories if credential revocation were detected. The recovered configuration additionally contained misleading/contradictory flags (safeMode: true, actualPersist: false, canaryPercent: 5) that code analysis found did not match actual call-graph behavior.

Attribution is unresolved. The payload self-identifies as "M-RED-TEAM v6.4" and shares artifact naming, obfuscation tooling (javascript-obfuscator custom-alphabet config), and infrastructure-naming conventions (miasma-test-org, miasma-monitor.service, Miasma-tagged Nostr relays) with the open-source "Miasma" toolkit released publicly in June 2026, as well as dead-drop URL slug patterns ("elzotebo") matching a prior PR-flood campaign researchers term "prt-scan." However, researchers at Wiz explicitly declined definitive attribution, and JFrog/SafeDep analysis found the AsyncAPI deployment differs substantially from the June 2026 Red Hat-wave Miasma campaign in runtime (vanilla Node.js vs. Bun), payload staging location (persistent per-user directories vs. /tmp), crypto primitives (secp256k1+AES-256-GCM vs. RSA-4096+AES-256-CBC), and C2 design (persistent encrypted HTTP channel vs. GitHub-repo-based exfiltration), suggesting a copy-paste/rebrand of prior tooling by a distinct or evolved operator rather than a like-for-like reuse.

Aikido Security detected and disclosed the compromised packages on 2026-07-14. Remediation guidance from responders (Aikido, Wiz, JFrog, SafeDep, Upwind) converges on: pin/downgrade to the last-known-clean versions (@asyncapi/specs@6.11.1, @asyncapi/generator@3.3.0, @asyncapi/generator-helpers@1.1.0, @asyncapi/generator-components@0.7.0); remove the compromised versions from lockfiles/manifests; treat build-host and developer credentials as fully compromised and rotate npm tokens, GitHub tokens (including write tokens for both asyncapi/generator and the related asyncapi/spec-json-schemas repository, which was separately compromised), SSH/signing keys, AWS credentials, and CI/CD secrets from clean machines; hunt for the sync.js drop file and OS-specific persistence artifacts on any system that merely imported the affected modules (installation alone is sufficient exposure, since the payload fires on require/import, not only on npm install); and purge the compromised alpha tarball from CDN/package-registry backing storage. Longer-term hardening includes eliminating pull_request_target on workflows with external PR checkout, dependency allowlisting/SBOM generation, and enhanced build-environment/package-integrity monitoring.