AsyncAPI npm Supply Chain Attack: Pwn-Request GitHub Actions Compromise Deploys Miasma Tasking Framework

AsyncAPI npm Supply Chain Attack (TL-2026-1360), also tracked as Miasma tasking framework campaign, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-07-15 and last reviewed 2026-09-08. It is attributed to M-Red-Team with low confidence, affects AsyncAPI Initiative @asyncapi/generator (npm), maps to 42 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 47 indicators of compromise.

Key facts for TL-2026-1360

Threat ID
TL-2026-1360
Also known as
Miasma tasking framework campaign, AsyncAPI pwn-request supply chain attack
Severity
CRITICAL
CVSS
9.8
Status
MITIGATED
Category
SUPPLY_CHAIN
First published
2026-07-15
Last reviewed
2026-09-08
Attribution
M-Red-Team
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, software-development, cloud-services, any-npm-consumer
Target regions
Global
Detection rules
9
Indicators of compromise
47
Updates
2026-09-08 · revalidated 1× · latest source

Malware and tooling in AsyncAPI npm Supply Chain Attack

Malware and tooling: Miasma, 0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710

An attacker exploited a 'pwn request' flaw in a misconfigured pull_request_target GitHub Actions workflow (manual-netlify-preview.yml) to steal a privileged asyncapi-bot Personal Access Token, then used the AsyncAPI project's own legitimate release pipelines and npm OIDC trusted-publisher integration to push five malicious @asyncapi package versions carrying valid SLSA provenance. The packages deployed a three-stage dropper culminating in a 744-module, 92,000-line Miasma-family tasking framework with six independent C2 channels (HTTP, Nostr, IPFS, BitTorrent DHT, libp2p GossipSub, Ethereum smart contract), credential/wallet theft, AI coding-assistant poisoning, LAN worm propagation, and a dead man's switch that wipes local directories if the stolen token is revoked.

How AsyncAPI npm Supply Chain Attack works

On 2026-04-29 a researcher reported a pull_request_target misconfiguration in asyncapi/generator's manual-netlify-preview.yml workflow; a proposed fix on 2026-05-17 was never merged. On 2026-07-14 an attacker weaponized the flaw: they opened 37 pull requests against asyncapi/generator, almost all a noisy decoy adding a fake charity donation page, while PR #2155 hid obfuscated JavaScript after roughly 1,000 bytes of whitespace. Because manual-netlify-preview.yml triggered on pull_request_target but checked out attacker-controlled PR code, the workflow executed with base-repository secrets and exfiltrated a highly privileged Personal Access Token belonging to the asyncapi-bot service account.

At 06:58 UTC the attacker pushed commit 3eab3ec9304aa26081358330491d3cfeb55cc245 to the next branch under the placeholder git identity "Your Name <you@example.com>" (GitHub API resolved the email as invalid, consistent with a compromised push credential rather than a legitimate contributor). This automatically triggered the project's own release-with-changesets.yml workflow via npm's GitHub OIDC trusted-publisher integration at 07:10 UTC, publishing @asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, and @asyncapi/generator-components@0.7.1 with valid SLSA provenance attestations -- attestations that prove only that the authorized workflow produced the artifact, not that the triggering commit was legitimate. Between 07:51-07:56 UTC the same attacker pushed commit 36269ce81837 to the master branch of asyncapi/spec-json-schemas, causing the if-nodejs-release.yml workflow to publish @asyncapi/specs@6.11.2-alpha.1 (08:06 UTC) and @asyncapi/specs@6.11.2 (08:30 UTC). Combined, the four packages see roughly 2-3 million weekly downloads.

Unlike prior npm supply-chain attacks that relied on postinstall lifecycle hooks (now restricted by npm v12), the dropper was injected directly into legitimate source files (apps/generator/lib/templates/config/validator.js, packages/helpers/src/utils.js, packages/components/src/utils/ErrorHandling.js, and the specs package's compiled ESM index.js) and fires the moment the module is require()'d during normal build or CI use -- not at npm install time. Stage 1 spawns a detached, stdio-suppressed Node.js child process (windowsHide:true) that downloads an encrypted Stage 2 blob from IPFS (CID QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9 for the generator packages, Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf for specs) and drops it to an OS-specific hidden path (sync.js under NodeJS support directories on Windows/macOS/Linux). Stage 2 decrypts an 8.25MB bundle using AES-256-GCM with HKDF-SHA256 key derivation (labels rt-vault-master-key-32b-aaaaaaaa, rt-file-key-material-v1, rt-baked-key) to yield Stage 3: a 3.08-3.09MB, ~92,000-line JavaScript tasking framework that self-identifies in code as both "miasma-train-p1" and "M-RED-TEAM v6.4".

The framework implements 744 bundled modules and 12+ command handlers (file listing/retrieval/write, shell execution, payload update, beacon-interval update, credential ciphering, node signing) across six independent C2 channels: primary HTTP/REST beaconing to 85.137.53.71:8080 (/api/v1/beacon, /api/v1/file-result) with dedicated upload (8081) and proxy-management (8091) ports, Nostr relay fallback (wss://relay.damus.io, wss://relay.nostr.com), IPFS, BitTorrent DHT (router.bittorrent.com, router.utorrent.com, dht.transmissionbt.com), libp2p GossipSub P2P mesh, and an Ethereum smart contract (0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710) as a blockchain dead-drop fallback. Credential-theft targets npm/GitHub/PyPI tokens, SSH keys, browser-stored passwords, macOS Keychain, and AWS/Azure/GCP cloud credentials. A dedicated ai-tool-poisoner.js module targets Claude Code, GitHub Copilot, and Cursor configuration, meaning any AI coding session on an affected workstation must be treated as compromised. LAN lateral movement uses subnet scanning and mDNS discovery; a metamorphic mutation engine supports polymorphic re-propagation, though baked configuration toggles for PyPI/RubyGems/Cargo/cryptocurrency propagation modules were observed disabled despite the code being present. Persistence is established via a systemd user service (~/.config/systemd/user/miasma-monitor.service, Restart=always), crontab, macOS launchd, and Windows Registry Run keys. Anti-analysis logic terminates on detected sandboxes/VMs, on hosts with a Russian system locale, or where CrowdStrike, SentinelOne, Microsoft Defender, CarbonBlack, Cylance, Osquery, Tanium, or Qualys are present. A dead man's switch continuously monitors validity of the stolen token and triggers a local directory wipe if it is revoked.

All five malicious versions were unpublished from npm between 11:12-11:18 UTC on 2026-07-14 (exposure windows of roughly 2h48m-4h3m); the latest dist-tags now resolve to clean versions (generator@3.3.0, generator-helpers@1.1.0, generator-components@1.0.0, specs@6.11.1). Researchers note code-level obfuscation overlaps and shared naming conventions with the prior Red Hat Cloud Services npm 'Miasma: The Spreading Blight' campaign (itself built on leaked/open-sourced Shai-Hulud code) and the 'prt-scan' Rentry dead-drop campaign, but caution that no definitive attribution has been established -- one analysis argues the 'Miasma' strings may be a deliberate false-flag to mislead responders. Regardless of branding, defenders should treat any endpoint or CI runner that imported or executed one of the five affected package versions as compromised: rotate npm/GitHub/SSH/cloud credentials, remove dropper artifacts and orphaned processes, audit CI egress logs for connections to ipfs.io, 85.137.53.71, DHT bootstrap nodes, or Nostr relays, and treat AI coding-assistant sessions on affected hosts as untrusted.

MITRE ATT&CK techniques used in TL-2026-1360

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1518.001 Security Software Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1564.001 Hidden Files and Directories

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.003 Cron; T1543.001 Launch Agent; T1543.002 Systemd Service; T1546.004 Event Triggered Execution; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.004 Command and Scripting Interpreter; T1059.007 JavaScript; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1095 Non-Application Layer Protocol; T1102.002 Bidirectional Communication; T1102.003 Web Service; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

Initial Access

T1195.001 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Impact

T1485 Data Destruction

Credential Access

T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.004 Unsecured Credentials; T1552.005 Cloud Instance Metadata API; T1555.001 Keychain; T1555.003 Credentials from Web Browsers

Lateral Movement

T1570 Lateral Tool Transfer

Resource Development

T1583.004 Server; T1588.001 Malware

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in AsyncAPI npm Supply Chain Attack

  • AsyncAPI Initiative — @asyncapi/generator (npm)
    Vulnerable versions: 3.3.1
    Fixed in: 3.3.0 (rollback)
  • AsyncAPI Initiative — @asyncapi/generator-helpers (npm)
    Vulnerable versions: 1.1.1
    Fixed in: 1.1.0 (rollback)
  • AsyncAPI Initiative — @asyncapi/generator-components (npm)
    Vulnerable versions: 0.7.1
    Fixed in: 1.0.0
  • AsyncAPI Initiative — @asyncapi/specs (npm)
    Vulnerable versions: 6.11.2; 6.11.2-alpha.1
    Fixed in: 6.11.1 (rollback)

Remediation for AsyncAPI npm Supply Chain Attack

Patches

  • Upgrade to clean dist-tag versions: @asyncapi/generator@3.3.0, @asyncapi/generator-helpers@1.1.0, @asyncapi/generator-components@1.0.0, @asyncapi/specs@6.11.1
  • Merge the previously-proposed (2026-05-17) fix for the manual-netlify-preview.yml pull_request_target misconfiguration

Immediate actions

  • Pin/lockfile-freeze dependencies below the malicious versions and regenerate lock files to prevent resolution of @asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, @asyncapi/specs@6.11.2, @asyncapi/specs@6.11.2-alpha.1
  • Remove dropper artifacts from documented drop paths (sync.js under NodeJS support directories) and kill orphaned detached Node.js processes
  • Block/monitor outbound connections to 85.137.53.71, ipfs.io payload CIDs, listed Nostr relays, and BitTorrent DHT bootstrap nodes at network egress
  • Treat any CI runner or workstation that require()'d an affected version during build/CI as compromised, not just those that ran npm install

Workarounds

  • Temporarily vendor or mirror AsyncAPI generator toolchain from a known-clean commit/tag until upstream workflow hardening is confirmed

Longer-term hardening

  • Audit all pull_request_target-triggered GitHub Actions workflows for checkout-of-untrusted-code (pwn request) patterns and require explicit approval gates for first-time/external contributors
  • Scope service-account PATs (e.g. asyncapi-bot) to least privilege and rotate on a schedule
  • Deploy CI egress monitoring/allowlisting (e.g. Harden-Runner-class tooling) to catch anomalous outbound connections during builds
  • Do not treat npm OIDC/SLSA provenance as a proxy for commit legitimacy -- provenance proves the authorized workflow ran, not that the triggering commit was authored by a trusted party

Weaknesses (CWE) in AsyncAPI npm Supply Chain Attack

CWE-829, CWE-494, CWE-506, CWE-522, CWE-269, CWE-287, CWE-913, CWE-94, CWE-200

Timeline of AsyncAPI npm Supply Chain Attack

  • Security researcher reports a pull_request_target misconfiguration in asyncapi/generator's manual-netlify-preview.yml GitHub Actions workflow, warning it allows PR-controlled code to run with base-repository secrets.
  • A fix for the manual-netlify-preview.yml pwn-request flaw is proposed but never merged, leaving the workflow exploitable.
  • 08:49 UTC - First observed downstream fetch of a malicious package version (specs@6.11.2) into a Yarn cache, confirming real-world propagation during the exposure window.
  • 08:40 UTC - asyncapi-bot is stripped of admin privileges and downgraded to read-only and all tokens are rotated; the compromised next branch was deleted at 07:44 UTC.
  • 07:50 UTC - External researcher LidorMachluf publicly discloses the compromise via asyncapi/generator GitHub Issue #2184.
  • 05:28 UTC - Maintainers begin incident response; the exploit PR is isolated by 06:09 UTC and the repository is locked to org-member-only PRs by 06:12 UTC.
  • PR #2155 (commit 47be388), which triggered the PAT-stealing workflow run at 05:11 UTC (Run 29307859879), was closed by the attacker and a clean commit (ff010ef) force-pushed to mask the exploit from standard diff review.
  • 05:04 UTC - Attacker begins flooding asyncapi/generator with 37 AI-generated pull requests to exhaust maintainer triage bandwidth ahead of the malicious PR #2155.
  • 11:12-11:18 UTC - All five malicious package versions are unpublished from the npm registry; clean dist-tags restored.
  • 08:06 UTC and 08:30 UTC - if-nodejs-release.yml publishes @asyncapi/specs@6.11.2-alpha.1 and @asyncapi/specs@6.11.2.
  • 07:51-07:56 UTC - Same attacker pushes commit 36269ce81837 to the master branch of asyncapi/spec-json-schemas using the identical placeholder git identity.
  • 07:10 UTC - release-with-changesets.yml auto-triggers via npm GitHub OIDC trusted publishing, publishing @asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, and @asyncapi/generator-components@0.7.1 with valid SLSA provenance.
  • 06:58 UTC - Attacker pushes commit 3eab3ec9304aa26081358330491d3cfeb55cc245 to the next branch of asyncapi/generator under the placeholder git identity 'Your Name <you@example.com>'.
  • 05:16 UTC - The vulnerable manual-netlify-preview.yml workflow completes on PR #2155, exfiltrating a privileged Personal Access Token belonging to the asyncapi-bot service account.
  • 05:08 UTC - Attacker opens 37 pull requests against asyncapi/generator; nearly all add a fake charity donation page as noise, while PR #2155 hides obfuscated JavaScript after roughly 1,000 bytes of whitespace.
  • AsyncAPI publishes its own official incident postmortem detailing root cause, four systemic failures, and remediation steps, alongside third-party technical analyses.
  • Socket, StepSecurity, OX Security, Wiz, SafeDep, Aikido and The Hacker News publish coordinated technical analyses of the compromise and the Miasma-family payload.

Update history for TL-2026-1360

Sources cited for AsyncAPI npm Supply Chain Attack

Threats related to AsyncAPI npm Supply Chain Attack

Detection coverage for TL-2026-1360

As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1360 across Splunk SPL, Microsoft KQL and Sigma, covering 47 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1360

5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats