Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

1. Executive summary

Four npm packages in the @asyncapi namespace (@asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, and @asyncapi/specs at v6.11.2 and v6.11.2-alpha.1) were published on 2026-07-14 carrying a multi-stage botnet loader. The attacker gained push access to the repositories' next branch and leveraged each project's own legitimate GitHub Actions release workflow to publish packages with valid npm OIDC provenance attestations — no npm token was stolen. The malicious payload executes on module load (not on install), downloads an encrypted second-stage payload called "Miasma" from IPFS, and establishes a 744-module command framework with six independent C2 channels (HTTP, Nostr relay, IPFS, BitTorrent DHT, libp2p GossipSub, and an Ethereum smart contract). EMEA financial services with JavaScript/Node.js build pipelines consuming AsyncAPI tooling are at risk of developer-environment compromise, credential theft, and lateral movement. All five malicious versions have been unpublished from npm.

2. Regulatory framing

3. Technical analysis & attack chain

Initial access vector: The attacker gained push access to the next branch of the AsyncAPI generator monorepo. Commits were pushed under a placeholder git identity. The project's own legitimate GitHub Actions release workflow then published the packages to npm via GitHub OIDC trusted-publisher integration. The resulting packages carry valid SLSA provenance attestations — proving only that the authorised workflow produced them, not that the triggering commits were legitimate. No npm token was stolen. This is a CI/CD pipeline compromise, not a stolen-credential or malicious-maintainer scenario.

Affected packages and versions

All five versions have been unpublished from the npm registry as of the report date.

Attack chain (confirmed steps)

1. Repository push access compromise. Attacker obtained push access to the next branch of the AsyncAPI generator monorepo. Method of obtaining push access is not specified in the source material.
2. Malicious commit injection. Attacker pushed commits under a placeholder git identity. Each commit injected an obfuscated JavaScript source file into the package.
3. Legitimate CI/CD pipeline publishing. The project's real GitHub Actions release workflow published the packages to npm. Packages carry valid npm OIDC provenance attestations because the legitimate pipeline, not a stolen token, performed the publish.
4. Execution on module load (not install). Unlike typical npm supply-chain attacks that leverage postinstall hooks, the malicious code in these packages executes when the infected module is loaded by Node.js (require/import). This bypasses install-time security controls and package managers that only inspect lifecycle scripts.
5. Detached background node process. Upon module load, the injected code launches a detached background node process that downloads and executes the second-stage payload from IPFS.
6. Second-stage download from IPFS. The downloader URL is ipfs[.]io/ipfs/QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9. The downloaded payload is an encrypted JavaScript loader named sync.js, written to OS-specific paths and executed.
7. Miasma tasking framework deployment. sync.js contains two components: - An encrypted final JavaScript payload that decodes to the Miasma tasking framework. - A large encrypted blob used by the runtime's spawn-chain framework.
8. C2 communication via six channels. The Miasma framework bundles 744 modules and supports six independent C2 communication channels: - HTTP (REST-based C2 — the clearest operational path: the implant beacons to an HTTP endpoint, accepts encrypted tasking, posts command results back) - Nostr relay - IPFS - BitTorrent DHT - libp2p GossipSub P2P mesh - Ethereum smart contract
9. Persistence. Miasma establishes persistence via: - systemd (Linux) - crontab (Linux/macOS) - macOS launchd - Windows Registry autostart keys
10. Anti-analysis and evasion. The malware avoids systems identified as sandboxes or virtual environments. It also avoids systems with the current language set to Russian. It checks for the presence of security tools: CrowdStrike, SentinelOne, Microsoft Defender, CarbonBlack, Cylance, Osquery, Tanium, and Qualys.
11. Dead man's switch. The malware monitors a stolen token and triggers a directory wipe if the token is revoked.

Miasma capabilities (confirmed)

• Credential theft
• AI tool poisoning
• LAN lateral movement
• Worm-like propagation across npm, PyPI, and Cargo registries
• Upload transport
• Command ciphering
• Node signing
• Payload updates
• File management
• Shell execution
• Persistence writing

Attribution caveat: The malware contains the "Miasma" string multiple times inside its code and shares similarities with the Shai-Hulud and Miasma campaigns. However, per OX Security researcher Moshe Siman Tov Bustan, this malware is not attributed to the Miasma/Shai-Hulud/TeamPCP campaigns. No MITRE ATT&CK actor profile is available in the verified reference data for this item; attribution is unconfirmed. The method by which the attacker obtained push access to the next branch is not described in the source material.

Corroboration note: The core technical details are corroborated across four independent sources: OX Security, SafeDep, Socket, and StepSecurity. The StepSecurity blog independently confirms the CI/CD pipeline compromise mechanism and the July 14, 2026 07:10 UTC publication timestamp. The Microsoft Threat Intelligence blog (corpus-2) describes a separate but thematically related campaign using dependency confusion and reconnaissance payloads — it is included as context on the broader threat landscape, not as corroboration of the AsyncAPI compromise itself.

4. Mitigation & containment

P1 — Within 24 hours

1. Identify affected package consumption. Search all package-lock.json, yarn.lock, pnpm-lock.yaml, and npm-shrinkwrap.json files across all repositories and build environments for: - @asyncapi/generator@3.3.1 - @asyncapi/generator-helpers@1.1.1 - @asyncapi/generator-components@0.7.1 - @asyncapi/specs@6.11.2 - @asyncapi/specs@6.11.2-alpha.1
2. Isolate affected build/CI/CD environments. If any of the above versions are found, treat the environment as potentially compromised. Quarantine the host or container. Do not simply delete the package — the malware executes on module load and may have already established persistence (systemd, crontab, launchd, Windows Registry).
3. Block C2 infrastructure at network egress. Block the IPFS gateway URL at proxy/egress filters: - ipfs[.]io/ipfs/QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9 - Consider blocking ipfs.io entirely if IPFS is not a business requirement.
4. Hunt for persistence mechanisms on any host that ran the affected packages: - Linux: inspect systemd unit files, crontab entries (crontab -l, /etc/cron.d/, /var/spool/cron/) - macOS: inspect launchd plists (~/Library/LaunchAgents/, /Library/LaunchAgents/, /Library/LaunchDaemons/) - Windows: inspect Registry autostart keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run) - Search for sync.js files in OS-specific temp/cache paths.
5. Rotate credentials for any developer environments, CI/CD secrets, or API tokens that may have been exposed on affected hosts. The malware performs credential theft and AI tool poisoning.

P2 — Within 72 hours

6. Pin to known-good versions. Downgrade or pin to the last known-clean version of each package: - @asyncapi/generator — pin to < 3.3.1 (e.g., 3.3.0 or earlier) - @asyncapi/generator-helpers — pin to < 1.1.1 (e.g., 1.1.0 or earlier) - @asyncapi/generator-components — pin to < 0.7.1 (e.g., 0.7.0 or earlier) - @asyncapi/specs — pin to < 6.11.2 (e.g., 6.11.1 or earlier)
7. Audit CI/CD pipeline branch protection. Review push access to next and other development branches on all repositories with npm publish workflows. Enforce branch protection rules requiring PR review and status checks before merge. Restrict who can push to branches that trigger release workflows.
8. Review provenance attestation assumptions. This incident demonstrates that SLSA/npm OIDC provenance attestations confirm only that the authorised workflow produced the package — not that the triggering commits were legitimate. Update supply-chain security guidance to reflect this gap. Provenance does not protect against a compromised push credential.
9. Scan for the Miasma framework. Search for the 744-module framework bundle and any node processes making outbound connections via Nostr relay, BitTorrent DHT, or libp2p GossipSub protocols — these are unusual for developer/build environments and serve as strong detection signals.

P3 — Within 7 days

10. Implement runtime module-load monitoring. Since this payload fires on require/import rather than on npm install, install-time scanning alone is insufficient. Deploy runtime instrumentation (e.g., Node.js --require hooks, module-load monitors) in CI/CD and development environments to detect unexpected network activity during module loading.
11. Review GitHub Actions OIDC trusted-publisher configurations across all repositories that publish to npm. Ensure that only protected branches can trigger publish workflows. Consider adding commit-signing verification as a workflow gate.
12. Conduct retrospective audit of all @asyncapi package usage in production build artifacts. If compromised versions were baked into container images or deployed artefacts, rebuild from clean base images with pinned, verified package versions.

5. Indicators of compromise

url  ipfs[.]io/ipfs/QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9
filename  sync.js
package  @asyncapi/generator@3.3.1
package  @asyncapi/generator-helpers@1.1.1
package  @asyncapi/generator-components@0.7.1
package  @asyncapi/specs@6.11.2
package  @asyncapi/specs@6.11.2-alpha.1

6. Detection

rule AsyncAPI_Miasma_Loader_2026 {
  meta:
    author = "Adverse Trace"
    date = "2026-07-15"
    reference = "https://thehackernews.com/2026/07/compromised-asyncapi-npm-packages.html"
    description = "Detects Miasma tasking framework payload delivered via compromised AsyncAPI npm packages"
  strings:
    $miasma_str = "Miasma" nocase
    $sync_js = "sync.js" nocase
    $ipfs_cid = "QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9"
    $nostr_relay = "Nostr" nocase
    $gossipsub = "GossipSub" nocase
    $bittorrent_dht = "BitTorrent DHT" nocase
    $libp2p = "libp2p" nocase
    $recon_flag = "RECON_ONLY"
    $spawn_chain = "spawn-chain"
  condition:
    $ipfs_cid or ($miasma_str and 2 of ($sync_js, $nostr_relay, $gossipsub, $bittorrent_dht, $libp2p, $spawn_chain))
}

title: Suspicious Node.js Process Downloading from IPFS
id: 7a3c1f2e-2026-0715-asyncapi-miasma
status: experimental
description: Detects detached node background processes downloading from IPFS, consistent with AsyncAPI Miasma loader behaviour
author: Adverse Trace
date: 2026/07/15
references:

  - https://thehackernews.com/2026/07/compromised-asyncapi-npm-packages.html
logsource:
  product: linux
  category: process_creation
detection:
  selection_process:
    Image|endswith: '/node'
    CommandLine|contains:

      - 'ipfs.io/ipfs/QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9'
  condition: selection_process
falsepositives:

  - Legitimate IPFS usage in development environments (verify against known IPFS workflows)
level: high

title: Miasma Persistence via Crontab or Launchd
id: 8b4d2a3f-2026-0715-miasma-persist
status: experimental
description: Detects persistence mechanisms consistent with Miasma framework (crontab, launchd, systemd, Windows Registry autostart)
author: Adverse Trace
date: 2026/07/15
references:

  - https://thehackernews.com/2026/07/compromised-asyncapi-npm-packages.html
logsource:
  product: linux
  category: file_event
detection:
  selection_crontab:
    TargetFilename|contains:

      - '/var/spool/cron/'
      - '/etc/cron.d/'
  selection_sync:
    TargetFilename|contains: 'sync.js'
  condition: selection_crontab or selection_sync
falsepositives:

  - Legitimate crontab modifications
level: medium

7. Sources

• The Hacker News — "Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware" — https://thehackernews.com/2026/07/compromised-asyncapi-npm-packages.html — 2026-07-15
• Step Security — "Compromised next Branch Pushes Malicious @asyncapi/generator, generator-helpers, and generator-components to npm" — https://www.stepsecurity.io/blog/compromised-next-branch-pushes-malicious-asyncapi-generator-generator-helpers-and-generator-components-to-npm — 2026-07-14/15
• Microsoft Threat Intelligence — "Malicious npm packages abuse dependency confusion to profile developer environments" — https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/ — 2026-05-29 (contextual — separate campaign)

8. Adverse Trace position

Severity: High. This is a significant supply-chain compromise of a widely trusted npm namespace (@asyncapi), published through a legitimate CI/CD pipeline with valid provenance attestations that would pass standard SLSA verification. The payload is sophisticated: 744 modules, six independent C2 channels, multi-platform persistence, anti-analysis evasion, a dead man's switch capable of directory wiping, and worm-like propagation across npm, PyPI, and Cargo. The execution-on-load trigger (rather than install-time hook) evades most current npm security tooling. Attribution is unconfirmed — the malware shares code-level similarities with the Miasma/Shai-Hulud campaigns but is explicitly stated by OX Security to be a distinct entity. EMEA financial services with Node.js/JavaScript build pipelines consuming AsyncAPI tooling should immediately audit lockfiles for the five affected versions, isolate any hosts that executed them, rotate exposed credentials, and hunt for Miasma persistence artefacts. We will monitor for additional affected packages, attribution developments, and any evidence of the worm-like propagation having reached PyPI or Cargo registries.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.