AsyncAPI npm Supply Chain Compromise: Import-Time Payload Delivery via Miasma Loader

AsyncAPI npm Supply Chain Compromise (TL-2026-1387), also tracked as Miasma npm supply chain attack, is a critical-severity supply-chain compromise scored CVSS 9.8, first published 2026-07-15 and last reviewed 2026-09-08. It has no confirmed attribution, affects AsyncAPI Initiative @asyncapi/specs, maps to 46 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 52 indicators of compromise.

Key facts for TL-2026-1387

Threat ID
TL-2026-1387
Also known as
Miasma npm supply chain attack, AsyncAPI generator compromise, M-RED-TEAM v6.4 campaign
Severity
CRITICAL
CVSS
9.8
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-15
Last reviewed
2026-09-08
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
softwaredevelopment, technology, cloudservices, devops, opensourceecosystem
Target regions
Global
Detection rules
9
Indicators of compromise
52
Updates
2026-09-08 · revalidated 1× · latest source

Malware and tooling in AsyncAPI npm Supply Chain Compromise

Malware and tooling: Miasma RAT, Trojan:JS/MiasmStealer.SC, Trojan:JS/SpawnLoader.MKV!MTB, Trojan:JS/VaultLoader.MJZ!MTB, Trojan:Script/Supychain.A, 0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710

On July 14, 2026, an attacker abused a misconfigured GitHub Actions workflow to gain push access to AsyncAPI repositories and let the project's own trusted-publishing CI/CD pipeline republish five malicious versions across four npm packages (@asyncapi/specs, @asyncapi/generator, @asyncapi/generator-components, @asyncapi/generator-helpers). The poisoned packages carry a modular loader that fires at import/require time — not via npm lifecycle scripts — bypassing the common `npm install --ignore-scripts` mitigation, and download the Miasma RAT/botnet framework from IPFS.

How AsyncAPI npm Supply Chain Compromise works

On July 14, 2026, attackers compromised the AsyncAPI npm publishing pipeline through legitimate CI/CD abuse rather than direct npm token theft. A decoy campaign of roughly 37 pull requests (most adding a fake charity donation page to camouflage the real attack) was opened against the asyncapi/generator repository; one PR exploited a misconfigured GitHub Actions workflow using `pull_request_target` with untrusted head-commit checkout (in `manual-netlify-preview.yml`), which carried a broadly privileged GITHUB_TOKEN and repository secret access. The attacker used this to obtain push access to the `next` branch of asyncapi/generator and the `master` branch of asyncapi/spec-json-schemas, then pushed malicious commits directly. This triggered the repositories' own legitimate release automation — `release-with-changesets.yml` fired within 12 seconds of the malicious push to asyncapi/generator, and `if-nodejs-release.yml` fired on a commit carrying a `fix:`/`feat:` prefix for spec-json-schemas — causing npm's GitHub Actions OIDC trusted-publisher integration to sign and publish the poisoned tarballs with valid SLSA/npm provenance attestations. Provenance verification therefore did not catch the attack: it only certifies that the authorized workflow produced the artifact, not that the triggering commit was legitimate.

Five malicious versions were published between 06:58 and 08:30 UTC on July 14, 2026: @asyncapi/generator@3.3.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator-helpers@1.1.1, @asyncapi/specs@6.11.2-alpha.1, and @asyncapi/specs@6.11.2 (stable). Microsoft observed the first downstream fetch of the poisoned @asyncapi/specs tarball into a Yarn cache at 08:49:22 UTC, roughly 40 minutes after publication, confirming active exploitation in the wild within the exposure window (07:10-11:18 UTC). The combined weekly download footprint of the four affected packages exceeds 2.9 million, with @asyncapi/specs alone accounting for roughly 2.7 million weekly downloads, making this one of the highest-blast-radius npm compromises of 2026.

Each injected package carries an import-time dropper rather than an install-time lifecycle hook (no preinstall/install/postinstall entries were declared in package.json), specifically to defeat `npm install --ignore-scripts` and hook-focused SCA/security scanners. The generator-family packages used raw obfuscated CommonJS padded with roughly 1,000 leading spaces per line to hide the payload in diffs; the specs package used an ESM/TypeScript-compiled obfuscator.io build with distinct decoder functions. When the poisoned module is `require()`d or imported during normal application/CI/build usage, the loader spawns a detached, stdio-ignored `node` child process (`spawn('node', [payloadPath], {detached: true, stdio: 'ignore'})`) that reconstructs a transport routine from an IPFS-hosted `sync.js` stager. That stager fetches an approximately 3.08 MB Node.js bundle from IPFS, decrypts it using HKDF-SHA256 (salt/info string `rt-file-key-material-v1` / `rt-file-key`) to derive AES-256-GCM keys plus an auxiliary ROT-style substitution cipher (shift=4, delta=90 across ASCII 33-126), and executes the decrypted payload: the Miasma RAT/botnet framework (internally versioned M-RED-TEAM v6.4 / Miasma RAT v3, campaign tags `miasma-train-p1` and `miasma-test-org`).

Miasma is a modular, multi-channel botnet framework comprising roughly 744 modules and a 12-command tasking protocol (Propagate, CollectData, UpdateMutationSeed, UpdatePayload, ManualSelfDestruct, BatchDispatch, FileList/FileGet/FilePut/FileDelete, ShellExec, UpdateBeaconInterval) with only `killall` blacklisted from shell execution, giving the operator near-arbitrary command execution on infected hosts. It supports six C2 channels for resilience against takedown: HTTP REST to a hardcoded IP, Nostr relays, IPFS, Ethereum blockchain (via a smart contract and a public RPC endpoint), BitTorrent DHT, and libp2p GossipSub mesh. The observed build shipped with credential harvesting (130+ target types spanning SSH keys, npmrc, AWS/Azure/GCP credentials, GitHub tokens/CLI config, browser-saved passwords, macOS Keychain, kubeconfig), LAN lateral-movement/subnet-scanning modules, an AI-coding-assistant poisoning module (targeting Claude Code, GitHub Copilot, Cursor sessions), a metamorphic/polymorphic re-obfuscation engine, and cross-ecosystem propagation stubs for PyPI, RubyGems, and Cargo -- but the credential harvesting, reconnaissance, and propagation capabilities were toggled disabled (`recon:false`, `propagate:false`) in this observed campaign build, indicating either a staged rollout, a testing/demonstration deployment, or throttled activation pending further operational decisions by the operator.

Persistence is established via platform-specific mechanisms: a Windows HKCU Run registry key (`miasma-monitor`), a Linux systemd user unit (`miasma-monitor.service`) plus crontab entries, a launchd agent on macOS, and shell RC file injection (.zshrc/.bashrc/.bash_profile) as a cross-platform fallback. The dropped stager and lock files masquerade under legitimate-looking `NodeJS` application-data directory names on all three major OS families to blend in with genuine Node.js installation artifacts.

Microsoft, Socket.dev, StepSecurity, Wiz, SafeDep, OX Security, Rescana, and The Hacker News independently corroborated the core technical findings (import-time execution, IPFS-hosted payload, hardcoded C2 IP, and the CI/CD trusted-publishing abuse mechanism), giving high confidence in the reported IOCs and mechanics. All five malicious versions have since been unpublished from the npm registry, with dist-tags reset to known-clean releases (@asyncapi/specs@6.11.1, @asyncapi/generator@3.3.0, @asyncapi/generator-helpers@1.1.0, @asyncapi/generator-components@1.0.0). No threat-actor attribution has been established; the poisoned commits carried a generic Git author identity ("Your Name <you@example.com>"), consistent with an opportunistic or as-yet-unidentified actor rather than a named APT group.

MITRE ATT&CK techniques used in TL-2026-1387

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Command and Control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1071.001 Web Protocols; T1095 Non-Application Layer Protocol; T1102.002 Web Service; T1104 Multi-Stage Channels; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573.001 Encrypted Channel

Defense Evasion

T1027 Obfuscated Files or Information; T1027.001 Obfuscated Files or Information; T1027.009 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Persistence

T1053.003 Cron; T1078 Valid Accounts; T1543.003 Create or Modify System Process; T1546.004 Unix Shell Configuration Modification; T1547 Boot or Logon Autostart Execution; T1547.001 Registry Run Keys / Startup Folder; T1547.006 Kernel Modules and Extensions

Credential Access

T1056.004 Credential API Hooking; T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1552.001 Unsecured Credentials; T1555 Credentials from Password Stores

Execution

T1059 Command and Scripting Interpreter; T1059.007 JavaScript; T1129 Shared Modules

Initial Access

T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Impact

T1565 Data Manipulation; T1565.001 Data Manipulation

Lateral Movement

T1570 Lateral Tool Transfer

Resource Development

T1584 Compromise Infrastructure

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in AsyncAPI npm Supply Chain Compromise

  • AsyncAPI Initiative — @asyncapi/specs
    Vulnerable versions: 6.11.2-alpha.1; 6.11.2
    Fixed in: 6.11.1 or earlier
  • AsyncAPI Initiative — @asyncapi/generator
    Vulnerable versions: 3.3.1
    Fixed in: 3.3.0
  • AsyncAPI Initiative — @asyncapi/generator-components
    Vulnerable versions: 0.7.1
    Fixed in: 1.0.0
  • AsyncAPI Initiative — @asyncapi/generator-helpers
    Vulnerable versions: 1.1.1
    Fixed in: 1.1.0

Remediation for AsyncAPI npm Supply Chain Compromise

Patches

  • @asyncapi/specs >= 6.11.1 (or later clean release)
  • @asyncapi/generator >= 3.3.0 (or later clean release)
  • @asyncapi/generator-components >= 1.0.0 (or later clean release)
  • @asyncapi/generator-helpers >= 1.1.0 (or later clean release)

Immediate actions

  • Remove all five compromised versions (@asyncapi/specs 6.11.2-alpha.1 and 6.11.2, @asyncapi/generator 3.3.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator-helpers 1.1.1) from every system that resolved them during the 07:10-11:18 UTC 2026-07-14 exposure window
  • Purge npm and Yarn package caches, especially shared caches on CI/CD build hosts and container image layers
  • Delete and regenerate all package-lock.json/yarn.lock files created during the exposure window
  • Hunt for sync.js under masquerading 'NodeJS' application-data directories (%LOCALAPPDATA%\NodeJS, ~/Library/Application Support/NodeJS, ~/.local/share/NodeJS, ~/.config/NodeJS)
  • Search for orphaned/detached node processes referencing IPFS CIDs or spawned with detached:true/stdio:ignore
  • Block outbound connections to 85.137.53.71 on ports 8080, 8081, and 8091
  • Block or restrict public IPFS gateways (ipfs.io, dweb.link, cloudflare-ipfs.com) at the network perimeter for build/CI environments where not business-required
  • Rotate all credentials reachable from affected environments: npm tokens, GitHub PATs, SSH keys, AWS/Azure/GCP credentials, browser-saved passwords, kubeconfig

Workarounds

  • Pin AsyncAPI dependencies to explicit known-good versions rather than caret/tilde ranges until confidence in the registry is restored
  • Note: npm install --ignore-scripts provides NO protection against this campaign since the payload fires at require/import time, not via lifecycle hooks

Longer-term hardening

  • Review all GitHub Actions workflows for pull_request_target misconfigurations combined with untrusted head-commit checkout
  • Enforce least-privilege GITHUB_TOKEN permissions and branch protection on release-triggering branches
  • Update npm CLI to v11.10.0+ or configure the min-release-age feature to delay trust in brand-new package versions
  • Treat OIDC/SLSA provenance attestations as proof of workflow execution only, not proof that the triggering commit was authorized -- pair with commit/branch integrity controls
  • Force known-safe package versions via npm/yarn overrides for transitive AsyncAPI dependencies
  • Rebuild affected CI/CD images and production artifacts from known-good dependency trees
  • Review AI coding assistant session logs (Claude Code, GitHub Copilot, Cursor) on affected machines for potential poisoning; treat AI-generated code from those machines as untrusted pending review

Weaknesses (CWE) in AsyncAPI npm Supply Chain Compromise

CWE-506, CWE-829, CWE-494, CWE-94

Timeline of AsyncAPI npm Supply Chain Compromise

Showing the 20 most recent tracked events.

  • Security fix PR #2092 for the manual-netlify-preview.yml pull_request_target vulnerability is opened but never merged, sitting in the organizational backlog until the attack.
  • A prior linked Miasma wave compromises the @redhat-cloud-services npm namespace using the same OIDC trusted-publishing abuse, establishing tooling lineage to the Shai-Hulud platform later associated with TeamPCP.
  • Internet scanners first observe ports 8080 and 8081 open on C2 host 85.137.53.71 (AS43641 SOLLUTIUM, Haarlem NL), hours before the attack.
  • 08:40 UTC -- the AsyncAPI team strips asyncapi-bot permissions to read-only and rotates the associated tokens.
  • ~07:50 UTC -- external security researchers disclose that malicious packages are live on npm; the compromised generator 'next' branch is deleted at 07:44 UTC.
  • 05:17 UTC -- the exfiltrated asyncapi-bot GitHub PAT plus Netlify auth token/site ID are posted to rentry.co/elzotebo seconds after the privileged CI job exits, later overwritten with the string 'Hello'; this is the mechanism by which the attacker obtained the org-wide push access used at 06:58 UTC.
  • Exposure window spans 07:10-11:18 UTC before detection and containment activity begins
  • 08:49:22 UTC - Microsoft observes the first downstream fetch of the poisoned @asyncapi/specs tarball into a Yarn cache, roughly 40 minutes after publication, confirming active in-the-wild exploitation
  • 08:30:09 UTC - @asyncapi/specs@6.11.2 stable release published with the identical malicious payload
  • 08:06:20 UTC - @asyncapi/specs@6.11.2-alpha.1 published carrying the identical injected payload
  • ~07:10 UTC - @asyncapi/generator@3.3.1, @asyncapi/generator-components@0.7.1, and @asyncapi/generator-helpers@1.1.1 published with the injected Miasma loader via legitimate CI/CD and valid OIDC provenance
  • 07:05:42 UTC - release-with-changesets.yml release workflow triggered by the malicious push
  • 06:58:42 UTC - Attacker pushes malicious code authenticated as asyncapi-bot, confirming credential/push-access compromise
  • 05:11:05 UTC - Docs Preview workflow initiated, exposing a broadly privileged GITHUB_TOKEN via the misconfigured manual-netlify-preview.yml workflow
  • 05:08:58 UTC - Malicious PR #2155 commit (47be388) created, targeting the docs-preview workflow via a crafted pull_request_target trigger
  • Attacker opens roughly 37 pull requests against asyncapi/generator, most adding a fake charity donation page as camouflage for the real attack
  • TL-Intel Harness ingests and researches the compromise via RSS hunt of the Microsoft Security Blog advisory
  • All five malicious versions unpublished from the npm registry; dist-tags reset to known-clean releases (@asyncapi/specs@6.11.1, @asyncapi/generator@3.3.0, @asyncapi/generator-helpers@1.1.0, @asyncapi/generator-components@1.0.0)
  • Socket.dev, StepSecurity, Wiz, SafeDep, OX Security, Rescana, and The Hacker News independently publish corroborating technical writeups
  • Microsoft Security Blog publishes technical analysis 'Unpacking AsyncAPI npm supply chain compromise: import-time payload delivery'

Update history for TL-2026-1387

Sources cited for AsyncAPI npm Supply Chain Compromise

Threats related to AsyncAPI npm Supply Chain Compromise

Detection coverage for TL-2026-1387

As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1387 across Splunk SPL, Microsoft KQL and Sigma, covering 52 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1387

5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats