AsyncAPI npm Supply Chain Attack via Miasma Malware

In July 2026, a highly sophisticated supply chain attack targeted the AsyncAPI npm organization, affecting packages with over 2 million weekly downloads. The attackers gained push access to repositories and leveraged legitimate GitHub Actions pipelines to publish malicious versions (@asyncapi/generator, @asyncapi/generator-components, @asyncapi/generator-helpers, and @asyncapi/specs) carrying valid OIDC provenance attestations. While the malware mimics past campaigns by TeamPCP (Shai-Hulud and Miasma), researchers suggest this is a distinct evolution designed to mislead attribution.

The attack chain involves a multi-stage dropper that bypasses traditional install-hook monitoring by triggering only when the module is loaded via `require()`. Once active, the malware (dubbed Miasma) functions as a hybrid Remote Access Trojan (RAT), info-stealer, and crypto-stealer. It utilizes a complex decentralized infrastructure for Command and Control (C2), including IPFS, BitTorrent DHT, and Ethereum smart contracts, making it exceptionally resilient to standard network-level blocking.

This incident is critical due to its targeting of developer environments and its ability to self-propagate by stealing npm, PyPI, and Cargo tokens to infect further registries. Organizations using AsyncAPI tools should immediately rotate all developer credentials and audit CI/CD pipelines for unauthorized commits made under placeholder identities.