The malicious versions were published on July 141414, 202620262026, within around 909090 minutes. A
ffected packages include @asyncapi/specs versions 6.11.2-alpha.1 and 6.11.2, @asyncapi/generator@3.3.1, @asyncapi/generator-components@0.7.1, and @asyncapi/generator-helpers@1.1.1.
The incident is significant because @asyncapi/specs is a transitive dependency for many AsyncAPI tools.
This means the malicious code could have reached developer systems, CI/CD runners, container builds, and production workloads that installed and imported the compromised versions.
Unlike many npm supply-chain attacks, this campaign did not use preinstall or postinstall scripts.
Instead, the malware executed when an affected module was imported using require() or import. As a result, using npm install –ignore-scripts would not have prevented execution.
Microsoft said the injected code launched a hidden Node.js process that downloaded a second-stage payload named sync.js from IPFS.
The payload was linked to a modular malware framework called Miasma, which includes command-and-control, persistence, decentralized communications, and credential theft capabilities.
AsyncAPI Supply-Chain Secrets Theft
The attack reportedly began with a malicious pull request against the asyncapi/generator repository.
The attacker abused a GitHub Actions workflow configured with pull_request_target. This setting runs workflows with access to the base repository’s security context.
The workflow also checked out attacker-controlled pull request code and had access to repository credentials and secrets. This unsafe combination likely allowed the attacker to obtain a privileged token associated with asyncapi-bot.
The attacker then used the bot identity to push unauthorized commits to auto-publishing branches. Rather than directly breaching npm, the threat actor abused the project’s legitimate release workflow to publish poisoned packages.
The packages were released through GitHub OpenID Connect trusted publishing under the identity npm-oidc-no-reply@github[.]com.
They also carried valid provenance attestations because the builds originated from legitimate repositories and authorized GitHub Actions workflows.
However, the source commits that triggered those releases were unauthorized.
The incident demonstrates that provenance signatures confirm where and how an artifact was built, but cannot independently confirm that a trusted source repository or release workflow was not already compromised.
The malicious loader was inserted into package files that would normally execute during application startup. It spawned a detached Node.js child process with hidden execution settings and retrieved sync.js from hard-coded IPFS locations.
On Windows, the payload was written to %LOCALAPPDATA%\NodeJS\sync.js. Linux systems used ~/.local/share/NodeJS/sync.js, while macOS systems used ~/Library/Application Support/NodeJS/sync.js.
The downloaded sync.js file contained an encrypted 8.28.28.2 MB Miasma runtime. Its active configuration supported persistence, remote command execution, file upload and download, proxying, and data exfiltration.
Persistence mechanisms included a Windows Registry Run key named miasma-monitor, a Linux systemd user service named miasma-monitor.service, and shell profile modifications on macOS.
The analyzed build contained credential-harvesting modules that were turned off at the time of analysis. However, the code was capable of targeting more than 100100100 environment variables and credential files commonly found on developer workstations and build systems.
Potential targets included GITHUB_TOKEN, NPM_TOKEN, AWS access keys, Azure client secrets, Google Cloud service account credentials, Docker tokens, Kubernetes credentials, SSH private keys, .npmrc files, and HashiCorp Vault tokens.
The framework communicated with 85.137.53[.]71 over ports 808080808080, 808180818081, and 809180918091. It also supported fallback channels through IPFS, Nostr, Ethereum, BitTorrent DHT, and libp2p, increasing its resilience if the main command-and-control infrastructure was blocked.
Microsoft Defender detects related artifacts as Trojan, JS/MiasmStealer.SC and Trojan: Script/Supychain.A. Organizations should immediately identify and remove the affected versions, including transitive dependencies in lockfiles, artifact repositories, and build caches.
Teams should purge npm and Yarn caches, search endpoints for sync.js within suspicious Node.js directories, and investigate detached Node.js processes. They should also block the identified IP address and IPFS content identifiers where possible.
Most importantly, organizations should rotate all credentials accessible from any developer machine, build runner, or service that imported the affected packages.
Rebuilding containers, golden images, and CI runners from known-good dependency baselines is also essential to prevent poisoned caches or persistence mechanisms from spreading into future builds.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
