AsyncAPI: Five npm Packages Compromised with Valid Provenance

Attackers hijacked the AsyncAPI project's CI/CD pipeline on July 14, 2026, stealing the asyncapi-bot service account token and publishing five malicious npm package versions with technically valid provenance attestations. The Miasma payload executes at module import time — not during installation — rendering the standard `--ignore-scripts` mitigation ineffective. The incident exposes a structural paradox in the modern software supply chain: when the source repository falls, the build signature becomes a guarantee of compromised code.

On July 14, 2026, attackers compromised the CI/CD pipelines of the AsyncAPI open-source project, stealing the asyncapi-bot service account token and publishing five malicious npm package versions with technically valid provenance attestations. The Miasma payload activates at module import time, not during installation, rendering the standard --ignore-scripts mitigation ineffective. The incident exposes a structural paradox in the modern supply chain: when the source repository falls, the build signature becomes a guarantee of compromised code.

Key Takeaways

The vulnerable workflow used pull_request_target with checkout of PR code, exposing the GITHUB_TOKEN and repository credentials.
Five malicious versions published in roughly 90 minutes via npm trusted publishing with GitHub OIDC, carrying valid attestations but originating from unauthorized commits.
The Miasma payload executes at import time (require/import), with cross-platform persistence via Windows Registry, Linux systemd, and macOS shell profile modifications.
The vulnerability was reported on April 29, 2026, with a fix proposed on May 17, left unmerged for 58 days until the attack.

How the Breach Opened: The Pwn Request in GitHub Actions

Attackers opened 37 pull requests against the asyncapi/generator repository over the course of July 14, 2026. A single one, PR #2155, exploited a docs-preview workflow configured with pull_request_target, according to Wiz Research. This mode runs the workflow in the base repository's context, with full access to secrets, but the checkout of PR code introduced attacker-controlled code into the privileged environment.

The workflow completed at 05:16 UTC and the token was exfiltrated. At 06:58 UTC the malicious commit 3eab3ec was pushed directly to the next branch, triggering the release workflow at 07:10 UTC. The window between vulnerability identification and exploit lasted 58 days: the responsible disclosure with proof-of-concept arrived on April 29, the fix proposal on May 17, both left unmerged.

"This is dangerous because pull_request_target runs in the base repository context with full access to secrets. When the workflow checks out attacker-controlled code from the pull request and executes it, those secrets become accessible." — Wiz Research

The Miasma Payload: Import-Time Execution and Evasion of Standard Controls

The five compromised versions — @asyncapi/generator@3.3.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator-helpers@1.1.1 (07:10 UTC), @asyncapi/specs@6.11.2-alpha.1 (08:06 UTC), and @asyncapi/specs@6.11.2 stable (08:30 UTC) — contained a loader inserted into legitimate source files, hidden behind roughly 1,000 bytes of whitespace padding. The code executed as the first "off-screen" line, outside standard editor view.

Unlike most npm supply-chain attacks, this campaign did not use preinstall or postinstall scripts. According to Microsoft Threat Intelligence, the malware executed at module import time via require() or import, rendering the --ignore-scripts mitigation ineffective. The first stage spawned a detached Node.js process with hidden execution; the second downloaded sync.js from IPFS, an encrypted bundle of roughly 8.2 MB; the third activated the modular Miasma runtime, comprising approximately 92,000 lines of code.

The runtime included six modules implemented but disabled in the analyzed build: credential harvesting, encrypted exfiltration, supply-chain propagation, metamorphic generation, AI-tool poisoning, and sandbox evasion. The dossier does not specify whether these modules were activated in other unanalyzed builds.

The Provenance Paradox: Valid Signatures, Betrayed Origin

All malicious versions were published via npm trusted publishing with GitHub OIDC, carrying technically valid provenance attestations. According to Microsoft Threat Intelligence, "the attestations accurately identified the legitimate repositories, commits, and workflows that produced the packages, even though the triggering commits were unauthorized." This is the core of the paradox: the integrity signature worked exactly as designed, but conferred apparent legitimacy on code compromised upstream.

The source does not specify the nature of the data actually exfiltrated. The payload self-identifies as "M-RED-TEAM v6.4" in code comments. Documented persistence mechanisms include: Windows Registry key miasma-monitor, Linux user systemd service miasma-monitor.service, and macOS shell profile modifications. The sync.js installation paths are respectively %LOCALAPPDATA%\NodeJS\sync.js, ~/.local/share/NodeJS/sync.js, and ~/Library/Application Support/NodeJS/sync.js.

The primary C2 resides at 85.137.53.71 on ports 8080, 8081, and 8091, with fallback to IPFS (CIDs QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9 and Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf for the react-sdk variant), Nostr relays (relay.damus.io, relay.nostr.com), Ethereum smart contract 0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710, BitTorrent DHT, and libp2p. Unit 42 identified the campaign name "miasma-train-p1".

What to Do Now

Immediate rotation of developer credentials, GitHub and npm tokens, cloud keys (AWS, Azure, GCP), and CI/CD secrets exposed in repositories that imported the compromised packages.
Hunt for the sync.js file in paths %LOCALAPPDATA%\NodeJS\, ~/.local/share/NodeJS/, and ~/Library/Application Support/NodeJS/, and for detached Node.js processes with hidden execution.
Purge package manager caches and verify dependency lockfiles to identify @asyncapi versions in the 07:10–08:30 UTC window on July 14, 2026.
Review GitHub Actions pull_request_target configurations with checkout of untrusted PR code, and check for PRs opened by unrecognized accounts in the last 30 days.

The Gaps That Remain Open

The dossier does not establish with certainty how the asyncapi-bot token was obtained: Microsoft's public logs "do not show how the credential was acquired." It is not documented whether the request to the rentry.co dead-drop with URL "elzotebo" — linked to prt-scan campaign patterns — was actually executed and succeeded in the compromised workflow.

No infrastructure overlaps definitively link the actor to specific threat actors at this stage: Wiz Research explicitly states it does not perform definitive attribution. The full extent of victims and actual data exfiltration remain unquantified. The link to the Red Hat @redhat-cloud-services incident of June 2026, which employed the same Miasma payload with a different initial access vector, has not been confirmed.

The evolution from install-time to import-time attacks signals an offensive adaptation against standard JavaScript supply-chain defenses. When provenance validation becomes an attacker's tool rather than an obstacle, the line between legitimate build and compromised build shifts from the registry to the source repository — and to the speed with which an open-source community can patch what it already knew was broken.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references