AsyncAPI npm Supply Chain Attack: Import-Time Malware Bypasses Script Safeguards
Harish Kumar 
A sophisticated supply chain attack against the widely used @asyncapi npm organization has revealed a troubling evolution in how threat actors compromise open-source ecosystems, bypassing traditional install-script defenses entirely by triggering malicious code at the moment a package is imported.
On July 14, 2026, Microsoft Threat Intelligence identified that attackers had republished five poisoned package versions across four AsyncAPI packages within a ninety-minute window: @asyncapi/specs (versions 6.11.2-alpha.1 and 6.11.2), @asyncapi/generator@3.3.1, @asyncapi/generator-components@0.7.1, and @asyncapi/generator-helpers@1.1.1.
Because @asyncapi/specs sits as a transitive dependency across numerous tooling packages, the blast radius extended well beyond direct consumers, hitting developer workstations, CI/CD pipelines, and production builds alike.
AsyncAPI npm Supply Chain Attack
Most npm supply chain attacks rely on postinstall hooks, a pattern security tools now routinely scan for. This campaign sidestepped that defense entirely. The injected loader executed the moment any application called require() or import on the compromised module.
That distinction matters: the common npm install --ignore-scripts mitigation, long treated as a reliable safeguard, does nothing here because no lifecycle hook was ever declared.
Once triggered, the loader spawned a hidden, detached Node.js process that fetched a second-stage payload, sync.js, from IPFS.
This ~8.2 MB encrypted bundle unpacked into a modular runtime dubbed Miasma, complete with active command-and-control channels, persistence mechanisms, and decentralized fallback communication paths, including Nostr, Ethereum, BitTorrent DHT, and libp2p.
The intrusion traces back to a malicious pull request against asyncapi/generator’s docs-preview workflow. The workflow used pull_request_target while checking out untrusted PR code, a well-documented anti-pattern that placed attacker-controlled commits inside a privileged security context.
This exposed the asyncapi-bot’s personal access token, letting the attacker push directly to auto-publish branches.From there, the attacker didn’t need to breach npm itself.
They simply rode the project’s legitimate GitHub OIDC release pipeline, producing packages with valid provenance attestations, accurate in every detail except that the underlying commits were unauthorized.
Analysts recovered six additional capability modules built into Miasma but left dormant in this build: credential harvesting, encrypted exfiltration, supply-chain propagation, metamorphic generation, AI-tool poisoning, and sandbox evasion.
The credential-harvesting module alone targets over 100 environment variable names spanning GitHub, npm, AWS, Azure, GCP, Kubernetes, and AI platform tokens, suggesting this incident may be a controlled test run ahead of a larger campaign.
- Remove all five affected package versions and pin known-good releases
- Purge npm and Yarn caches across developer machines and CI systems
- Hunt for sync.js and OS-specific “NodeJS” masquerade directories
- Block outbound traffic to 85.137.53[.]71 on ports 8080, 8081, and 8091
- Rotate all credentials accessible from environments that imported affected versions
- Adopt npm’s
min-release-agefeature or upgrade to npm CLI v11.10.0+
Microsoft Defender Antivirus detects the malicious artifacts as Trojan:JS/MiasmStealer.SC and Trojan:Script/Supychain.A, with Microsoft Defender for Endpoint providing behavioral coverage for the underlying process and network activity.
This incident underscores a broader lesson: securing the software supply chain now requires scrutiny of CI/CD pipeline permissions and OIDC publishing trust, not just the packages that emerge from them.
About the Author
Kiran 
