Compromised AsyncAPI npm Packages Traced to CI Credential Theft
Summary
Datadog traced malicious code in five AsyncAPI npm package versions to stolen CI credentials, linking the compromise to a vulnerable GitHub Actions workflow and detailing the malware, attack path, and indicators of compromise.
Key points
- On July 14, 2026, attackers compromised four AsyncAPI npm packages and published five malicious versions, affecting packages with more than 3 million weekly downloads in total.
- The attacker reportedly exploited a vulnerable pull_request_target workflow to steal GitHub and Netlify credentials from a CI runner, then used the release bot's credentials to publish the packages.
- Affected versions are @asyncapi/generator 3.3.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator-helpers 1.1.1, and @asyncapi/specs 6.11.2 and 6.11.2-alpha.1.
- The injected code downloaded a second-stage payload from IPFS that harvested cloud, Kubernetes, npm, and messaging-platform credentials from developer environments.
- The malware also targeted persistence through VS Code and Claude configuration files and used cryptographically validated commands with fallback C2 channels.
- The article provides indicators including the C2 IP 85.137.53.71, the IPFS payload URL, and the local artifact path ~/.cache/.sys_cache/.diag.enc.
Article Details
- Attack Vectors
- A vulnerable GitHub Actions workflow using pull_request_target ran attacker-submitted code from a pull request, enabling theft of GitHub and Netlify credentials from the CI environment.
- The attacker used compromised asyncapi-bot GitHub credentials to introduce malicious code into the repository and publish compromised npm package versions.
- The compromised packages fetched and executed a second-stage payload that harvested developer-environment credentials.
- Defensive Notes
- The article identifies these affected versions: @asyncapi/generator 3.3.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator-helpers 1.1.1, and @asyncapi/specs 6.11.2 and 6.11.2-alpha.1.
- Use the article's Software Composition Analysis query to identify affected package versions, and hunt for traffic to the listed second-stage URL and command-and-control IP.
- Review CI workflows that use pull_request_target and allow pull-request code to run without maintainer approval.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 85[.]137[.]53[.]71 | Command-and-control server IP; the article reports associated ports 8080 and 8081. |
| URL | hxxp[:]//85[.]137[.]53[.]71:8080 | Command-and-control URL listed in the malware configuration. |
| URL | hxxp[:]//85[.]137[.]53[.]71:8081 | Upload server URL listed in the malware configuration. |
| URL | hxxp[:]//85[.]137[.]53[.]71:8091 | C2 proxy-management URL listed in the malware configuration. |
| URL | hxxps[:]//ipfs[.]io/ipfs/QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9 | Specific IPFS resource identified as the second-stage payload. |
| URL | hxxps[:]//rentry[.]co/elzotebo | Rentry paste URL used to exfiltrate stolen CI credentials. |
| URL | hxxps[:]//rentry[.]co/elzotebo999 | Rentry paste URL used to retrieve the CI attack's second-stage code. |
MITRE ATT&CK
T1059.007 · JavaScriptThe injected JavaScript executed in the CI workflow and the package's second-stage payload ran through Node.js.T1195.002 · Compromise Software Supply ChainMalicious code was introduced through a compromised repository and delivered to users in compromised npm packages.T1552.001 · Credentials In FilesThe second-stage payload searched developer environments for credentials in files including .aws/credentials and .kube/config.T1567.003 · Exfiltration to Text Storage SitesThe CI payload exfiltrated stolen credentials to a Rentry paste.
Products
GitHub Actionsnpm provenance for the malicious version, showing it was built and signed on GitHub Actions from the project's CI pipeline (click to enlarge)NetlifyWe kept looking and found a pull request from a legitimate contributor that fixes a "PwnRequest" vulnerability in the Docs Preview (Netlify) CI job.npmOn July 14, 2026, four npm packages in the @asyncapi namespace, totaling over 3 million weekly downloads, were compromised to distribute malicious code.