{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/@asyncapi/generator-helpers@1.1.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@asyncapi/generator@3.3.1","@asyncapi/generator-components@0.7.1","@asyncapi/generator-helpers@1.1.1","@asyncapi/specs (6.11.2-alpha.1)","@asyncapi/specs (6.11.2)"],"_cs_severities":["critical"],"_cs_tags":["supply-chain","npm","github-actions","malware","javascript","nodejs","ci-cd"],"_cs_type":"advisory","_cs_vendors":["AsyncAPI"],"content_html":"\u003cp\u003eMicrosoft Threat Intelligence identified a coordinated supply chain compromise affecting the \u003ccode\u003e@asyncapi\u003c/code\u003e npm organization on July 14, 2026. Threat actors exploited a misconfigured GitHub Actions workflow to steal a privileged \u003ccode\u003easyncapi-bot\u003c/code\u003e Personal Access Token (PAT), enabling them to inject heavily obfuscated malware loaders into five package versions across four AsyncAPI npm packages. These poisoned packages were then published via the project's legitimate CI/CD pipeline, including \u003ccode\u003e@asyncapi/specs\u003c/code\u003e (6.11.2-alpha.1, 6.11.2), \u003ccode\u003e@asyncapi/generator@3.3.1\u003c/code\u003e, \u003ccode\u003e@asyncapi/generator-components@0.7.1\u003c/code\u003e, and \u003ccode\u003e@asyncapi/generator-helpers@1.1.1\u003c/code\u003e. The malicious code, identified as \u003ccode\u003eMiasma\u003c/code\u003e (detected as \u003ccode\u003eTrojan:JS/MiasmStealer.SC\u003c/code\u003e and \u003ccode\u003eTrojan:Script/Supychain.A\u003c/code\u003e), executes at module-load (import/require) time, effectively bypassing the \u003ccode\u003enpm install --ignore-scripts\u003c/code\u003e mitigation. This campaign impacts developer workstations, CI/CD pipelines, container builds, and production services that import the affected versions, establishing persistence and command and control, with capabilities for credential harvesting and propagation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker exploits a vulnerable GitHub Actions workflow (\u003ccode\u003epull_request_target\u003c/code\u003e) in the \u003ccode\u003easyncapi/generator\u003c/code\u003e repository by submitting a malicious pull request (e.g., PR #2155).\u003c/li\u003e\n\u003cli\u003eThe misconfigured workflow executes attacker-controlled code, leading to the theft of a privileged \u003ccode\u003easyncapi-bot\u003c/code\u003e Personal Access Token (PAT).\u003c/li\u003e\n\u003cli\u003eThe attacker uses the stolen PAT to push commits containing heavily obfuscated JavaScript loaders into AsyncAPI package source files (e.g., \u003ccode\u003eindex.js\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe project's legitimate CI/CD pipelines, authenticated via GitHub Actions OpenID Connect (OIDC) with the compromised identity \u003ccode\u003enpm-oidc-no-reply@github.com\u003c/code\u003e, publish the poisoned npm packages (e.g., \u003ccode\u003e@asyncapi/specs@6.11.2\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDownstream consumers download and import the compromised AsyncAPI packages; the malicious code executes at \u003ccode\u003erequire()\u003c/code\u003e or \u003ccode\u003eimport\u003c/code\u003e time, spawning a hidden, detached child process.\u003c/li\u003e\n\u003cli\u003eThe child process downloads the \u003ccode\u003esync.js\u003c/code\u003e second-stage payload (Miasma modular runtime) from an IPFS endpoint.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esync.js\u003c/code\u003e payload is written to an OS-specific \u0026quot;NodeJS\u0026quot; masquerade directory, establishing persistence and initiating active command and control (C2) communication with \u003ccode\u003e85.137.53.71\u003c/code\u003e on ports \u003ccode\u003e8080\u003c/code\u003e, \u003ccode\u003e8081\u003c/code\u003e, and \u003ccode\u003e8091\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Miasma runtime establishes resilient C2 communication channels and has capabilities for credential harvesting, encrypted exfiltration, and supply-chain propagation, though some modules were disabled in this observed build.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe compromise of AsyncAPI npm packages directly impacts developer workstations, CI/CD pipelines, container builds, and production services that resolved and imported the affected versions. The \u003ccode\u003eMiasma\u003c/code\u003e modular runtime establishes persistent access and active command and control, posing a significant risk for further exploitation, including potential credential harvesting, data exfiltration, and lateral movement within compromised environments. Microsoft Defender Antivirus detects the malicious artifacts as \u003ccode\u003eTrojan:JS/MiasmStealer.SC\u003c/code\u003e and \u003ccode\u003eTrojan:Script/Supychain.A\u003c/code\u003e. If successful, this supply chain attack could lead to widespread code integrity issues, intellectual property theft, and unauthorized access to development infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately remove all five affected package versions: \u003ccode\u003e@asyncapi/specs@6.11.2-alpha.1\u003c/code\u003e, \u003ccode\u003e@asyncapi/specs@6.11.2\u003c/code\u003e, \u003ccode\u003e@asyncapi/generator@3.3.1\u003c/code\u003e, \u003ccode\u003e@asyncapi/generator-components@0.7.1\u003c/code\u003e, and \u003ccode\u003e@asyncapi/generator-helpers@1.1.1\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ePurge npm and Yarn caches on all affected systems to ensure no cached malicious packages are re-installed.\u003c/li\u003e\n\u003cli\u003eHunt for the \u003ccode\u003esync.js\u003c/code\u003e file under \u0026quot;NodeJS\u0026quot; masquerade directories across developer workstations and CI/CD environments using \u003ccode\u003eDetect Miasma sync.js Payload Drop\u003c/code\u003e Sigma rule.\u003c/li\u003e\n\u003cli\u003eBlock outbound connections to \u003ccode\u003e85.137.53.71\u003c/code\u003e on ports \u003ccode\u003e8080\u003c/code\u003e, \u003ccode\u003e8081\u003c/code\u003e, and \u003ccode\u003e8091\u003c/code\u003e at your network perimeter using \u003ccode\u003eDetect Miasma C2 Network Connection\u003c/code\u003e Sigma rule.\u003c/li\u003e\n\u003cli\u003eRotate all credentials (including GitHub Personal Access Tokens and npm authentication tokens) that were accessible from any environment or service that imported the compromised packages.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules in this brief to your SIEM and tune for your environment to detect \u003ccode\u003eMiasma\u003c/code\u003e activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-16T01:50:36Z","date_published":"2026-07-16T01:50:36Z","id":"https://feed.craftedsignal.io/briefs/2026-07-asyncapi-npm-compromise/","summary":"Threat actors compromised AsyncAPI npm packages by exploiting a misconfigured GitHub Actions workflow, stealing a privileged bot token, and injecting obfuscated Miasma malware into multiple packages, which then executed at module-load time to establish persistence and command and control, bypassing standard npm installation mitigations.","title":"AsyncAPI npm Supply Chain Compromise via GitHub Actions","url":"https://feed.craftedsignal.io/briefs/2026-07-asyncapi-npm-compromise/"}],"language":"en","title":"CraftedSignal Threat Feed - @Asyncapi/Generator-Helpers@1.1.1","version":"https://jsonfeed.org/version/1.1"}