AsyncAPI Supply-Chain Attack Uses GitHub Actions Misconfiguration to Steal Credentials and Publish Malicious npm Packages
Summary
An attacker abused a vulnerable GitHub Actions workflow to steal an AsyncAPI service-account token and publish malicious npm packages. The packages deliver multi-stage malware capable of persistence, remote commands, and credential theft.
Key points
- The attacker used a pull_request_target workflow that checked out untrusted pull-request code, exposing repository secrets to attacker-controlled code.
- A stolen AsyncAPI bot token was used to push malicious commits and publish five compromised versions across four @asyncapi npm packages.
- The packages execute the payload on import or require; it downloads a second stage from IPFS and installs a persistent malware framework.
- The malware can steal browser credentials, SSH keys, npm and GitHub tokens, cloud credentials, macOS Keychain data, and cryptocurrency wallets.
- The malware communicates with command-and-control infrastructure over HTTP, Nostr relays, Ethereum smart contracts, and a libp2p mesh network; attribution remains unconfirmed.
- Organizations are advised to check developer workstations, CI/CD systems, repositories, and affected package versions, and rotate potentially exposed credentials and secrets.
- The article recommends dependency allowlisting, SBOM generation, package verification, and improved monitoring of developer and build environments.
Article Details
- Attack Vectors
- A GitHub Actions workflow used pull_request_target but checked out and executed code from an untrusted pull request, exposing repository secrets to attacker-controlled code.
- The attacker used the stolen Personal Access Token to push malicious commits to AsyncAPI repositories and trigger npm releases of compromised packages.
- The packages execute their payload when imported or required. The first stage downloads a second stage from IPFS, which launches a malware framework with credential theft, persistence, remote-command, and data-exfiltration capabilities.
- Defensive Notes
- Investigate developer workstations, CI/CD environments, and repositories for signs of compromise, and audit systems for the affected package versions.
- Assume GitHub tokens, SSH keys, cloud credentials, and CI/CD secrets may have been exposed; rotate them accordingly.
- Strengthen software supply-chain defenses with dependency allowlisting, SBOM generation, package verification, and improved monitoring of developer and build environments.
- Separate workflows that require secrets from jobs that execute untrusted pull-request code.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ipfs[.]io | Identified as payload-delivery infrastructure. |
| DOMAIN | rentry[.]co | Pastebin domain used for the token-exfiltration dead-drop URL. |
| IPV4 | 85[.]137[.]53[.]71 | Command-and-control server. |
| SHA1 | 22bf76fe317ea6769bd38619bd440e42d119bd6b | Hash of the malicious validator.js file in @asyncapi/generator. |
| SHA1 | 9890950adcbc2478e7a080234f053214adbad44e | Hash of the malicious ErrorHandling.js file in @asyncapi/generator-components. |
| SHA1 | a7e18d96efd3cdb127ef4cdcad9e3ad26c482bf2 | Hash of the malicious utils.js file in @asyncapi/generator-helpers. |
| SHA1 | c70e105e212ff3c1daa04bb2a62507717f296b0b | Hash of the malicious index.js file in @asyncapi/specs. |
| SHA1 | c8cb3f6d5b90c46686d2bf531dc1a5786e27edc5 | Hash of the Stage 2 sync.js payload. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe malware supports data exfiltration over its command-and-control infrastructure.T1059.007 · JavaScriptJavaScript hidden in a pull request and malicious package files executes in the workflow or when the packages are imported.T1071.001 · Web ProtocolsThe article reports command-and-control communication over HTTP.T1105 · Ingress Tool TransferThe first-stage payload downloads the next stage from IPFS.T1543.002 · Systemd ServiceThe payload establishes Linux persistence using systemd user services.T1552.004 · Private KeysThe malware targets SSH keys.T1555.003 · Credentials from Web BrowsersThe malware targets saved passwords and cookies in Chrome, Brave, Firefox, and Edge.
Malware
Products
AsyncAPIOn July 14, 2026, an attacker opened 37 pull requests to the AsyncAPI generator repository. Almost all attempted to add a fake charity donation page. Camouflage in the noise, a single PR exploited a misconfigured GitHubGitHub Actionsto add a fake charity donation page. Camouflage in the noise, a single PR exploited a misconfigured GitHub Actions workflow to steal a highly privileged Personal Access Token. npmFour malicious npm packages (five total versions) were published under the @asyncapi namespace. The packages contain a multi-stage payload that establishes persistence and connects to command and control infrastructure.