AsyncAPI npm Supply Chain Compromise: GitHub Actions Abuse to Miasma Implant

On July 14, 2026, researchers disclosed a supply chain compromise of the @asyncapi npm organization affecting five releases across four packages, including @asyncapi/specs, which alone draws roughly 2.7 million of the family's 2.9 million weekly downloads. What makes this campaign notable is not the entry vector, which is a now-familiar CI/CD abuse, but the payload: the malicious code executes on package import rather than at install time, and it delivers a full modular implant framework that self-identifies in source as M-RED-TEAM and brands its artifacts as Miasma. Attribution is inconclusive, with overlapping signals pointing at a prt-scan style pull request flood, the M-RED-TEAM implant lineage, and naming that echoes an earlier Miasma toolkit, though the current Node based payload diverges from the prior Bun based one.

Initial access came through a pull_request_target workflow in the asyncapi/generator repository that checked out the untrusted pull request head while retaining access to repository secrets. The actor opened a burst of pull requests and hid obfuscated JavaScript behind roughly a thousand bytes of whitespace in one of them, so that when the workflow ran it scanned the runner environment and exfiltrated the npm publish token and bot credential to a paste style dead drop. With a valid bot identity in hand, the actor pushed malicious commits to the release branch and let the trusted release workflow publish the backdoored packages to npm, which is why the publish stage surfaces in audit logs as a bot account driving releases.

The injected code was placed in modules that load during normal use, so simply importing a compromised package triggers it. Stage one spawns a detached Node process via an inline command evaluation, immediately unreferences the child, and fetches a multi megabyte obfuscated loader from a public IPFS gateway, writing it to disk under directories disguised as legitimate Node tooling. The loader decrypts the next stage using HKDF derived keys and authenticated encryption, then launches the Miasma implant, which generates a keypair, establishes persistence tailored to each operating system while masquerading as Node or NVM components, and beacons to a hardcoded raw IP command server on non standard ports roughly every thirty seconds. For resilience the implant also carries fallback channels over Nostr relays, an Ethereum smart contract, and a BitTorrent style distributed hash table.

Once resident, the implant runs credential harvesters that target browser saved passwords and cookies, SSH keys, npm and GitHub tokens, cloud provider credentials, the macOS Keychain, and cryptocurrency wallets, staging and returning results over the encrypted command channel with a plaintext fallback. The framework accepts tasking for file operations, shell execution, propagation, and self update, and it ships with a dormant destructive capability: a deadman wipe that was left disabled in this wave and is flagged by a simulation marker rather than triggering real destruction.