Two Compromised AsyncAPI Repositories Published npm Packages with a Miasma RAT Dropper
Summary
Attackers pushed commits to two AsyncAPI repositories, triggering GitHub Actions to publish five npm versions with a Miasma RAT dropper that runs when packages are loaded. No npm token was stolen; all versions were unpublished, but existing lockfiles may retain them.
Key points
- Commits pushed under a placeholder identity triggered the repositories’ legitimate GitHub Actions release workflows and npm OIDC publishing; the article says no npm token was stolen.
- Five malicious releases affected @asyncapi/generator, @asyncapi/generator-helpers, @asyncapi/generator-components, and @asyncapi/specs.
- The dropper runs when a poisoned package is loaded, not during installation. It launches a hidden, detached process that downloads a second-stage payload from IPFS.
- Static analysis identified Miasma RAT modules for credential harvesting, persistence, shell execution, and local-network discovery and propagation; these are reported capabilities, not evidence that each was used.
- In an isolated GitHub Actions job, StepSecurity observed outbound connection attempts to 85.137.53.71 and BitTorrent DHT nodes. The article says Harden-Runner blocked connections to listed infrastructure.
- Valid SLSA provenance attestations showed that authorized project workflows produced the packages, but did not establish that the triggering commits were legitimate.
- All five malicious versions were unpublished by 11:18 UTC on July 14, 2026. The article advises checking lockfiles and affected machines, removing the dropper, and rotating exposed credentials.
Article Details
- Attack Vectors
- An attacker pushed commits to two AsyncAPI repositories under the same placeholder Git identity; the article assesses a compromised credential or leaked automation token as consistent with the evidence, but does not identify the credential or operator.
- The commits injected obfuscated droppers into package code. The droppers execute when the affected library is loaded, rather than during npm installation.
- The compromised repositories' legitimate GitHub Actions release workflows published five malicious package versions through npm's GitHub OIDC trusted-publisher integration. The resulting provenance attested to the workflow and commit, not the legitimacy of the triggering commits.
- The dropper downloads sync.js from a specific IPFS resource, writes it to a hidden, OS-specific NodeJS directory, and launches it as a detached, hidden process.
- Static analysis identified Miasma v3 capabilities to harvest browser data, SSH keys, developer and cloud credentials, and application tokens; communicate over multiple C2 channels; establish persistence; scan local networks; and execute commands. The article does not establish that every capability was used in this incident.
- Defensive Notes
- The article reports that all five malicious package versions were unpublished by 11:18 UTC on July 14, 2026; it warns that existing lock files from the exposure window may still pin them.
- Regenerate affected lock files and verify that resolved package versions are clean. The article lists @asyncapi/[email protected], @asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/[email protected] as clean versions.
- Check affected machines for the OS-specific hidden NodeJS/sync.js drop file and terminate orphaned Node processes launched from a NodeJS directory under the user's home folder.
- Rotate credentials present on affected machines or CI runners, including npm and GitHub tokens, deploy keys, SSH keys, AWS credentials, Keychain entries, and browser-saved passwords and cookies.
- Review AI-assisted code or commands created on affected developer workstations during the exposure window, as the payload includes an AI-tool-poisoner module.
- Audit build and CI logs for unexpected outbound activity, including connections to the listed malicious C2 endpoints, the specific IPFS payload URL, BitTorrent DHT bootstrap nodes, and Nostr relays.
- The article reports that Harden-Runner observed outbound activity to 85.137.53.71 and that StepSecurity added C2 endpoints to its Global Block List. It recommends egress monitoring and blocking unexpected network activity from CI runners.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 85[.]137[.]53[.]71 | StepSecurity reports that monitored egress directly observed a connection attempt to this IP, identified as the HTTP C2 host; the article also associates it with credential upload and C2 proxy-management services. |
| URL | hxxp[:]//85[.]137[.]53[.]71:8080 | Primary HTTP C2 endpoint identified in the decrypted Miasma configuration. |
| URL | hxxp[:]//85[.]137[.]53[.]71:8081 | Credential-exfiltration upload endpoint identified in the decrypted Miasma configuration. |
| URL | hxxp[:]//85[.]137[.]53[.]71:8091 | C2 proxy-management endpoint identified in the decrypted Miasma configuration. |
| URL | hxxps[:]//ipfs[.]io/ipfs/QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9 | Specific IPFS-hosted sync.js payload resource that the dropper fetches. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe injected dropper is obfuscated, and static analysis found encrypted payload and configuration data in sync.js.T1041 · Exfiltration Over C2 ChannelThe decrypted configuration identifies an upload server for credential exfiltration over the malware's C2 infrastructure.T1046 · Network Service DiscoveryThe payload includes subnet-scan and LAN-discovery modules that can enumerate and attempt to spread across the local network.T1053.003 · CronThe payload's persistence module can write crontab entries.T1059.007 · JavaScriptThe dropper launches Node with an inline stage, then launches the downloaded sync.js Node application.T1071.001 · Web ProtocolsThe decrypted configuration identifies an HTTP REST channel, including HTTP C2 and credential-upload endpoints at 85.137.53.71.T1105 · Ingress Tool TransferThe dropper fetches the second-stage sync.js payload from the specific IPFS resource listed in the article.T1528 · Steal Application Access TokenThe token-vault module specifically targets GITHUB_TOKEN, NPM_TOKEN, and PYPI_TOKEN.T1539 · Steal Web Session CookieThe credential harvester targets browser cookie files, including profiles from Chrome, Brave, and Edge.T1543.001 · Launch AgentThe payload's persistence module can write macOS launchd persistence entries.T1543.002 · Systemd ServiceThe payload's persistence module can write systemd persistence entries.T1547.001 · Registry Run Keys / Startup FolderThe payload's persistence module can write Windows Registry autostart keys.T1552.001 · Credentials In FilesThe credential harvester targets credentials stored in files such as ~/.npmrc, ~/.aws/credentials, kube/config, and Docker credentials.T1552.004 · Private KeysThe credential harvester targets SSH private keys, including ~/.ssh/id_rsa and id_ed25519.T1555.003 · Credentials from Web BrowsersThe credential harvester targets browser Login Data and profile data from Chrome, Brave, and Edge.
Malware
Vendors
GitHubOn July 14, 2026, a coordinated supply chain attack hit two separate AsyncAPI GitHub repositories and produced four malicious npm packages carrying an obfuscated dropper that fires when the library is loaded, not atnpmcoordinated supply chain attack hit two separate AsyncAPI GitHub repositories and produced four malicious npm packages carrying an obfuscated dropper that fires when the library is loaded, not at install time. TheStepSecurityThe StepSecurity threat intelligence team identified the compromised packages within the first 30 minutes of publication. To protect pipelines, we needed to know where the malware sends stolen data.
Products
@asyncapi/generatorbranch injected a dropper into three packages, triggering release-with-changesets.yml to publish @asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/[email protected].@asyncapi/generator-componentsto publish @asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/[email protected].@asyncapi/generator-helpersthree packages, triggering release-with-changesets.yml to publish @asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/[email protected].@asyncapi/parsernpm install @asyncapi/[email protected] projects that received @asyncapi/[email protected] only as a transitive dependency via @asyncapi/parser, use overrides to force the safe version:@asyncapi/specsto the master branch injected a dropper into index.js, triggering if-nodejs-release.yml to publish @asyncapi/[email protected] and @asyncapi/[email protected].GitHub Actionsattacker gained push access to both repositories and, in each case, used the project's own legitimate GitHub Actions release pipeline to publish packages with valid OIDC provenance attestations. No npm token was stolen.
Tools
harden-runnerHarden-Runner Blocked Exfiltration During the AsyncAPI Supply Chain AttackObfuscator.ioThe commit injected the same ~7.7KB obfuscator.io-obfuscated payload, padded onto a single line with roughly a thousand leading spaces to push it off-screen in a diff view, into three files, one per affected package: