AsyncAPI npm Supply Chain Compromise: Import-Time Payload Delivery via Miasma Loader — Threadlinqs Intelligence
As of 2026-07-15, AsyncAPI npm Supply Chain Compromise: Import-Time Payload Delivery via Miasma Loader is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 41 indicators of compromise.
Threat ID: TL-2026-1387 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
On July 14, 2026, an attacker abused a misconfigured GitHub Actions workflow to gain push access to AsyncAPI repositories and let the project's own trusted-publishing CI/CD pipeline republish five
On July 14, 2026, attackers compromised the AsyncAPI npm publishing pipeline through legitimate CI/CD abuse rather than direct npm token theft. A decoy campaign of roughly 37 pull requests (most adding a fake charity donation page to camouflage the real attack) was opened against the asyncapi/generator repository; one PR exploited a misconfigured GitHub Actions workflow using `pull_request_target` with untrusted head-commit checkout (in `manual-netlify-preview.yml`), which carried a broadly privileged GITHUB_TOKEN and repository secret access. The attacker used this to obtain push access to the `next` branch of asyncapi/generator and the `master` branch of asyncapi/spec-json-schemas, then pushed malicious commits directly. This triggered the repositories' own legitimate release automation — `release-with-changesets.yml` fired within 12 seconds of the malicious push to asyncapi/generator, and `if-nodejs-release.yml` fired on a commit carrying a `fix:`/`feat:` prefix for spec-json-schemas — causing npm's GitHub Actions OIDC trusted-publisher integration to sign and publish the poisoned tarballs with valid SLSA/npm provenance attestations. Provenance verification therefore did not catch the attack: it only certifies that the authorized workflow produced the artifact, not that the triggering commit was legitimate.
Five malicious versions were published between 06:58 and 08:30 UTC on July 14, 2026: @asyncapi/generator@3.3.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator-helpers@1.1.1, @asyncapi/specs@6.11.2-alpha.1, and @asyncapi/specs@6.11.2 (stable). Microsoft observed the first downstream fetch of the poisoned @asyncapi/specs tarball into a Yarn cache at 08:49:22 UTC, roughly 40 minutes after publication, confirming active exploitation in the wild within the exposure window (07:10-11:18 UTC). The combined weekly download footprint of the four affected packages exceeds 2.9 million, with @asyncapi/specs alone accounting for roughly 2.7 million weekly downloads, making this one of the highest-blast-radius npm compromises of 2026.
Each injected package carries an import-time dropper rather than an install-time lifecycle hook (no preinstall/install/postinstall entries were declared in package.json), specifically to defeat `npm install --ignore-scripts` and hook-focused SCA/security scanners. The generator-family packages used raw obfuscated CommonJS padded with roughly 1,000 leading spaces per line to hide the payload in diffs; the specs package used an ESM/TypeScript-compiled obfuscator.io build with distinct decoder functions. When the poisoned module is `require()`d or imported during normal application/CI/build usage, the loader spawns a detached, stdio-ignored `node` child process (`spawn('node', [payloadPath], {detached: true, stdio: 'ignore'})`) that reconstructs a transport routine from an IPFS-hosted `sync.js` stager. That stager fetches an approximately 3.08 MB Node.js bundle from IPFS, decrypts it using HKDF-SHA256 (salt/info string `rt-file-key-material-v1` / `rt-file-key`) to derive AES-256-GCM keys plus an auxiliary ROT-style substitution cipher (shift=4, delta=90 across ASCII 33-126), and executes the decrypted payload: the Miasma RAT/botnet framework (internally versioned M-RED-TEAM v6.4 / Miasma RAT v3, campaign tags `miasma-train-p1` and `miasma-test-org`).
Miasma is a modular, multi-channel botnet framework comprising roughly 744 modules and a 12-command tasking protocol (Propagate, CollectData, UpdateMutationSeed, UpdatePayload, ManualSelfDestruct, BatchDispatch, FileList/FileGet/FilePut/FileDelete, ShellExec, UpdateBeaconInterval) with only `killall` blacklisted from shell execution, giving the operator near-arbitrary command execution on infected hosts. It supports six C2 channels for resilience against takedown: HTTP REST to a hardcoded IP, Nostr relays, IPFS, Ethereum blockchain (via a smart contract and a public RPC endpoint), BitTorrent DHT, and libp2p GossipSub mesh. The observed build shippe
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494
Target sectors: softwaredevelopment, technology, cloudservices, devops, opensourceecosystem
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 41 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1584, T1195, T1195.001, T1195.002, T1199, T1059, T1059.007, T1129, T1547, T1547.001