- Four @asyncapi npm packages were compromised on July 14, 2026, through a CI/CD pipeline attack, resulting in five malicious versions.
- The malware executes upon package import, not at install time, and downloads a sophisticated botnet framework from IPFS.
- The payload includes credential theft, AI tool poisoning, worm-like propagation, and multi-channel C2 using HTTP, Nostr, IPFS, BitTorrent, libp2p, and Ethereum.
- All malicious versions have been removed from npm, but organizations must regenerate lock files, rotate credentials, and audit affected systems.
On July 14, 2026, a coordinated supply chain attack struck the AsyncAPI open-source ecosystem, compromising four widely used npm packages that together see over 2.25 million weekly downloads. The attack leveraged trusted publishing pipelines in GitHub Actions, allowing malicious code to slip through without relying on traditional npm install hooks. Instead, the malware activates the moment a developer imports the compromised module, making it particularly dangerous for CI/CD environments and developer workstations.
Security researchers from multiple firms—including StepSecurity, OX Security, Socket, Wiz, and SafeDep—independently confirmed the incident. The attacker gained push access to two separate AsyncAPI GitHub repositories (asyncapi/generator and asyncapi/spec-json-schemas) and used the projects’ own release workflows to publish packages with valid SLSA provenance attestations. No npm token was stolen; the compromise exploited a misconfigured GitHub Actions workflow that allowed the attacker to push commits under a placeholder git identity (Your Name ).
Attack Timeline and Affected Packages
The first attack hit the asyncapi/generator repository at 06:58 UTC. A malicious commit to the next branch triggered the release-with-changesets.yml workflow, publishing three trojanized packages: @asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, and @asyncapi/generator-components@0.7.1. Just 15 minutes later, the attacker pivoted to the asyncapi/spec-json-schemas repository, pushing a series of commits to the master branch. This resulted in two additional malicious versions: @asyncapi/specs@6.11.2 and @asyncapi/specs@6.11.2-alpha.1. All five versions were published between 07:10 and 08:30 UTC, and the exposure window lasted until 11:18 UTC when the packages were finally unpublished.
What makes this attack particularly insidious is that the malicious code executes at import time, not at install. The payload is embedded directly into the main JavaScript files of each package—no preinstall or postinstall scripts are needed. For example, in @asyncapi/generator, the dropper lies in apps/generator/lib/templates/config/validator.js. When a build or CI job calls into the library, the obfuscated JavaScript spawns a hidden child process that downloads the next stage from IPFS.
Multi-Stage Malware: The Miasma Framework
The second stage, an encrypted file called sync.js (approximately 8.25 MB), is fetched from ipfs.io/ipfs/QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9 and saved to platform-specific directories (e.g., %LOCALAPPDATA%\NodeJS\sync.js on Windows). After decryption using HKDF-SHA256 and AES-256-GCM, the final payload emerges: a 3.09 MB modular botnet framework that self-identifies as “Miasma v3.” The framework bundles over 744 modules and supports six independent command-and-control channels, including HTTP REST, Nostr relays, IPFS gateways, BitTorrent DHT, libp2p GossipSub, and even Ethereum smart contracts. This multi-channel design ensures the attacker can maintain communication even if some endpoints are blocked.
The malware’s capabilities go far beyond credential theft. According to static analysis, it includes modules for credential harvesting (browser passwords, SSH keys, npm tokens, AWS credentials, macOS Keychain), AI tool poisoning (targeting Claude Code, GitHub Copilot, and Cursor), LAN lateral movement, and worm-like propagation across npm, PyPI, and Cargo registries. It also carries a metamorphic engine that re-obfuscates each copy, making detection harder. Notably, the operator set propagate.npm: false in this deployment, suggesting a targeted campaign rather than a mass worm.
Remediation and Long-Term Lessons
All five malicious versions have been removed from npm, and the latest dist-tags now point to clean releases. However, existing lock files generated during the exposure window (07:10–11:18 UTC) may still pin the compromised versions. Organizations should delete and regenerate lock files, then run a fresh npm install. Additionally, they must check for the hidden NodeJS/sync.js file on all affected systems, kill any orphaned child processes, and rotate every credential that was present on the machine—including GitHub tokens, SSH keys, AWS credentials, and browser-saved passwords.
Security teams should also audit build and CI logs for unexpected outbound connections to IPFS gateways, the C2 server at 85.137.53.71, BitTorrent bootstrap nodes, or Nostr relay domains. The attack underscores a critical blind spot: provenance attestations (SLSA) verify that a package came from an authorized workflow, but they do not guarantee that the triggering commit was legitimate. As supply chain attacks evolve, monitoring runtime behavior—not just install-time checks—becomes essential.
This incident is a stark reminder that the software supply chain is only as secure as the weakest link in the CI/CD pipeline. The attacker didn’t need to break npm’s defenses; they simply used the project’s own tools against it. Moving forward, organizations should implement cooldown periods for new package versions, enforce least-privilege for GitHub Actions, and use runtime monitoring tools like Harden-Runner to detect anomalous network activity. The AsyncAPI community has responded swiftly, but the blast radius—affecting millions of weekly downloads—shows how a single compromised push credential can ripple through the entire ecosystem.
