AsyncAPI’s npm ecosystem was hit by a supply chain attack that used compromised GitHub Actions workflows to distribute a Miasma-associated remote access trojan (RAT).
The malicious releases appeared under the project’s legitimate npm namespace, potentially exposing developer devices, CI/CD runners, documentation systems, and automated build environments.
AsyncAPI provides an open-source specification and tools for creating asynchronous and event-driven APIs.
Its generator tools convert API definitions into documentation, diagrams, source-code templates, and application scaffolding. They are commonly used with Apache Kafka, MQTT, AMQP, and WebSockets.
Because AsyncAPI packages may run on developer endpoints and in CI/CD systems, a compromise can put sensitive assets at risk.
These environments often hold GitHub tokens, npm publishing credentials, cloud keys, SSH keys, deployment secrets, and source-code access.
AsyncAPI Attack Delivers Miasma RAT
Security researchers reported that the attackers exploited a vulnerable GitHub Actions setup involving untrusted pull-request content and a privileged workflow context.
This enabled the threat actor to obtain or misuse an AsyncAPI automation identity, then make unauthorized changes within the project’s repositories.
The attacker added malicious code to a branch tied to AsyncAPI’s official release process. The project’s trusted automation subsequently built and published the altered packages through the real AsyncAPI npm namespace.
This approach made the packages particularly dangerous. The releases were not published from a suspicious new account or typosquatted package name.
Instead, they came from legitimate project workflows, making them likely to pass basic trust checks.
The injected code also avoided conventional npm lifecycle scripts such as postinstall. Instead, it executed when an affected module was imported.
That means an impacted package could be installed without immediately running malware, then activate later when a developer generated documentation, ran an application, or started a CI/CD build.
The first-stage JavaScript payload launched a detached Node.js process and downloaded an encrypted second-stage component from IPFS.
Researchers linked the behavior to Miasma, malware associated with credential theft, persistence, remote command execution, file operations, payload updates, and attacker command-and-control communications.
The malware also used an Ethereum smart contract as a fallback configuration source.
This allowed operators to update command-and-control endpoints, Nostr relay details, and BitTorrent DHT bootstrap information without republishing the compromised packages.
Such decentralized infrastructure makes takedown and blocking efforts more difficult, catonetworks said.
Although Miasma includes code associated with worm-like behavior, the observed AsyncAPI configuration primarily operated as a remote access tool.
It is therefore more accurate to describe the payload as a Miasma-associated RAT rather than assume it automatically spread in every affected environment.
The activity shares tactics with earlier campaigns involving Mini Shai-Hulud and the TeamPCP threat cluster.
Those operations targeted software publishers, CI/CD systems, cloud credentials, package registries, and trusted development tools. However, researchers have not conclusively attributed the AsyncAPI attack to TeamPCP.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
