Attack Chain

1. An attacker exploits a vulnerable GitHub Actions workflow (pull_request_target) in the asyncapi/generator repository by submitting a malicious pull request (e.g., PR #2155).
2. The misconfigured workflow executes attacker-controlled code, leading to the theft of a privileged asyncapi-bot Personal Access Token (PAT).
3. The attacker uses the stolen PAT to push commits containing heavily obfuscated JavaScript loaders into AsyncAPI package source files (e.g., index.js).
4. The project's legitimate CI/CD pipelines, authenticated via GitHub Actions OpenID Connect (OIDC) with the compromised identity npm-oidc-no-reply@github.com, publish the poisoned npm packages (e.g., @asyncapi/specs@6.11.2).
5. Downstream consumers download and import the compromised AsyncAPI packages; the malicious code executes at require() or import time, spawning a hidden, detached child process.
6. The child process downloads the sync.js second-stage payload (Miasma modular runtime) from an IPFS endpoint.
7. The sync.js payload is written to an OS-specific "NodeJS" masquerade directory, establishing persistence and initiating active command and control (C2) communication with 85.137.53.71 on ports 8080, 8081, and 8091.
8. The Miasma runtime establishes resilient C2 communication channels and has capabilities for credential harvesting, encrypted exfiltration, and supply-chain propagation, though some modules were disabled in this observed build.

Impact

The compromise of AsyncAPI npm packages directly impacts developer workstations, CI/CD pipelines, container builds, and production services that resolved and imported the affected versions. The Miasma modular runtime establishes persistent access and active command and control, posing a significant risk for further exploitation, including potential credential harvesting, data exfiltration, and lateral movement within compromised environments. Microsoft Defender Antivirus detects the malicious artifacts as Trojan:JS/MiasmStealer.SC and Trojan:Script/Supychain.A. If successful, this supply chain attack could lead to widespread code integrity issues, intellectual property theft, and unauthorized access to development infrastructure.

Recommendation

• Immediately remove all five affected package versions: @asyncapi/specs@6.11.2-alpha.1, @asyncapi/specs@6.11.2, @asyncapi/generator@3.3.1, @asyncapi/generator-components@0.7.1, and @asyncapi/generator-helpers@1.1.1.
• Purge npm and Yarn caches on all affected systems to ensure no cached malicious packages are re-installed.
• Hunt for the sync.js file under "NodeJS" masquerade directories across developer workstations and CI/CD environments using Detect Miasma sync.js Payload Drop Sigma rule.
• Block outbound connections to 85.137.53.71 on ports 8080, 8081, and 8091 at your network perimeter using Detect Miasma C2 Network Connection Sigma rule.
• Rotate all credentials (including GitHub Personal Access Tokens and npm authentication tokens) that were accessible from any environment or service that imported the compromised packages.
• Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect Miasma activity.