Executive Summary
On July 14, 2026, a coordinated supply chain attack targeted the @asyncapi NPM organization, resulting in the publication of five malicious package versions. The attacker, identified as ShinyHunters, exploited a 'pull_request_target' vulnerability in GitHub Actions to steal a privileged bot token, allowing them to push malicious code into legitimate release pipelines. This campaign is notable for its 'import-time' execution, meaning the payload runs immediately when a module is imported or required, bypassing standard mitigations like '--ignore-scripts'.\n\nThe technical attack chain involved an obfuscated loader that spawned a detached Node.js process to fetch a second-stage payload ('sync.js') from IPFS. This second stage decrypted the Miasma modular runtime, a sophisticated framework capable of command and control (C2), persistence across Windows, Linux, and macOS, and decentralized communication via protocols like Nostr and BitTorrent DHT. Although the core intent appeared to be credential harvesting and RAT functionality, many high-risk modules remained dormant in the analyzed build.\n\nThis incident highlights the critical risk of CI/CD pipeline misconfigurations and the evolution of supply chain delivery beyond installation hooks. Affected organizations must immediately rotate all credentials accessible from build or developer environments and purge local and shared NPM caches to ensure malicious artifacts are removed.