AsyncAPI: The Supply Chain That Trusted Its Own Signatures

On July 14, 2026, an attacker compromised the AsyncAPI release pipeline. Five malicious versions of four npm packages, with over two million weekly downloads, were distributed with valid SLSA provenance attestations: the digital signature meant to guarantee authenticity became the veil that made the malware indistinguishable from legitimate software.

The operation exploited a vulnerability known for months in a GitHub Actions workflow. The payload, identified as the M-RED-TEAM framework v6.4, executes at import-time — not at install-time — rendering the standard --ignore-scripts mitigation npm has promoted as a defense useless.

Key Takeaways

The attack began on July 14, 2026 at 05:08 UTC with a malicious pull request in the asyncapi/generator repository, exploiting a GitHub Actions workflow configured with pull_request_target that checked out untrusted code with access to the base repository's secrets.
Five malicious versions — @asyncapi/generator 3.3.1, generator-helpers 1.1.1, generator-components 0.7.1, specs 6.11.2-alpha.1, and specs 6.11.2 stable — were published between 07:10 and 08:30 UTC, all with valid SLSA provenance generated via GitHub OIDC trusted publishing.
The payload operates in three stages: an obfuscated downloader of roughly 3 KB in the packages' main/index.js files, an approximately 8.2 MB bundle encrypted with AES-256-GCM downloaded from IPFS, and the M-RED-TEAM framework v6.4 of roughly 92,000 lines with a modular architecture.
Command-and-control communication relies on a multi-channel network: HTTP to the address 85.137.53.71, IPFS, Nostr relays, an Ethereum smart contract at address 0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710, libp2p, and BitTorrent DHT bootstrap nodes.

The pull_request_target Trap

The entry vector had been documented for months. On April 29, 2026, the vulnerability in the manual-netlify-preview.yml workflow had already been identified, with a proof-of-concept and a proposed patch on May 17 that was never merged. The attacker opened 37 pull requests: 36 decoys with fake references to charities, and PR #2155 with the actual payload.

The pull_request_target configuration allowed the workflow to execute in the context of the base repository, where secrets were accessible. The obfuscated JavaScript code injected into the pull request aimed to exfiltrate a personal access token from the asyncapi-bot account to rentry[.]co/elzotebo999. According to Microsoft Threat Intelligence, the workflow logs do not explicitly show the success of the web request; the exact mechanism of token acquisition is not confirmed by available data.

With the token in hand — or via another unverified mechanism — the attacker pushed commits under a placeholder git identity, letting the legitimate, unmodified automatic release workflows publish the packages to npm via the OIDC trusted-publisher integration. As StepSecurity documented: "Both attacks are CI/CD pipeline compromises, not stolen npm tokens or malicious maintainers." The resulting Sigstore/Fulcio provenance attestations were technically authentic: they reported the correct repository, the correct workflow, the commit SHAs.

The Import-Time Bypass

The real tactical characteristic lies in the moment of activation. The malicious code is inserted into the main/index.js files of the compromised packages: it executes the moment an application does require() or import, not during the installation phase managed by npm install. This nullifies the protection offered by --ignore-scripts, the flag with which npm tried to mitigate supply chain attacks by limiting the execution of lifecycle hooks.

"npm's v12 is out, blocking post-install scripts, but threat actors didn't need to use them as they just embedded the malicious code inside the main JavaScript file without being blocked" — OX Security report, cited by Security Affairs

The first-stage payload is tiny, roughly 3 KB, with obfuscation techniques and whitespace padding to evade size-based detection. It triggers the download of the second stage, a sync.js file of roughly 8.2 MB hosted on IPFS and encrypted with AES-256-GCM with HKDF-SHA256 key derivation. Decryption and execution load the third stage: the M-RED-TEAM framework v6.4, which explicitly self-identifies in code comments according to Wiz Research analysis.

Decentralized C2 and Cross-Platform Persistence

The command-and-control infrastructure is designed to resist conventional takedowns. The primary channel is an HTTP server at address 85.137.53.71 on ports 8080, 8081, and 8091. Fallbacks leverage peer-to-peer and decentralized networks: IPFS content addressable via specific CIDs, Nostr protocol relays, an Ethereum smart contract for distributing configurations or addresses, and BitTorrent DHT bootstrap nodes connected via libp2p.

The payload implements persistence mechanisms on all three major platforms: a user-level systemd service named miasma-monitor.service on Linux, a key in the HKCU Run registry on Windows, and modifications to .zshrc and .bashrc files on macOS. Aikido's analysis highlights an implementation limitation: the systemd service lacks a shell wrapper in the ExecStart instruction, resulting in a likely failure of automatic startup. For the other two platforms, the brief does not verify the actual functioning of the persistence mechanisms.

The payload contains references to credential harvesting and self-propagation capabilities toward npm, PyPI, and Cargo, but Aikido's analysis confirms these capabilities were disabled in this build. A remote shell allowing manual execution remains active. The payload also includes anti-VM, anti-EDR, and anti-Russia checks: it terminates if it detects a Russian locale.

What to Do Now

The exposure window lasted approximately 4 hours and 7 minutes, from 07:10 to 11:18 UTC on July 14, 2026. During this interval the malicious packages were available on the npm registry before removal. Microsoft Threat Intelligence has published indicators of compromise and detection queries for Microsoft Defender.

The compromised packages are: @asyncapi/generator 3.3.1, generator-helpers 1.1.1, generator-components 0.7.1, specs 6.11.2-alpha.1, and specs 6.11.2. Previous versions are not affected. Wiz detected the attack via automated monitoring within 30 minutes of publication. StepSecurity performed independent runtime analysis with Harden-Runner confirming C2 behavior and blocked the IOCs in its Global Block List.

According to DeafNews analysis, the shift from centralized C2 to distributed infrastructure based on IPFS, Nostr, and blockchain represents, for this specific incident, a higher tactical complexity compared to traditional supply chain attacks. The ability to distribute payloads with valid SLSA provenance through compromised legitimate workflows — rather than via token theft or maintainer impersonation — indicates the attack surface has shifted to the integrity of the build process itself.

The next generation of defenses, according to DeafNews analysis, will have to address verification not only of the signature, but of the integrity of the process that generates it: a compromised repository produces technically valid but semantically treacherous attestations.

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references