AsyncAPI Malware Steals GitHub, npm, Cloud, and AI API Credentials

Key Takeaways

• A sophisticated supply chain attack compromised the AsyncAPI project on the npm registry, distributing malware across five package versions.
• The malware, dubbed Miasma, activates upon module import, bypassing common `ignore-scripts` defenses and targeting a wide array of credentials including GitHub, npm, cloud providers (AWS, Azure, GCP), Docker, Kubernetes, and AI platform API keys (Anthropic, OpenAI).
• The attack originated from a misconfigured GitHub Actions workflow, leading to the legitimate release of malicious packages, affecting developer workstations, CI/CD pipelines, containers, and potentially production environments.
• Affected organizations should immediately remove compromised package versions, purge caches, rotate all potentially exposed secrets, and scan for specific indicators of compromise.

AsyncAPI Project Hit by Advanced Supply Chain Attack

The AsyncAPI project, a critical component in many development ecosystems, recently fell victim to a severe supply chain attack on the npm registry. This incident exposed developers and automated build systems to a potent new form of malware designed to steal sensitive credentials.

On July 14, 2026, attackers republished five versions of AsyncAPI packages over approximately 90 minutes. Each of these compromised versions contained a stealthy loader that initiated its malicious activities immediately upon the module’s import, rather than relying on traditional installation scripts.

This “import-time” execution mechanism is particularly dangerous as it circumvents standard security measures, such as the widely adopted ignore-scripts setting, which is often used by development teams to prevent arbitrary code execution during package installation. Consequently, any application or build tool loading the poisoned module would inadvertently trigger the malware.

Microsoft Uncovers Miasma Framework

Security researchers at Microsoft identified and analyzed the campaign, detailing how a vulnerability in a GitHub Actions workflow facilitated the compromise. Microsoft said in a report that the second stage of the attack deploys a modular runtime framework named Miasma. This sophisticated framework is capable of establishing persistence, communicating with remote command-and-control servers, and deploying additional modules specifically designed for credential theft.

Given that @asyncapi/specs is a foundational dependency for numerous other AsyncAPI tools, the fallout from this attack extends broadly. It impacts developer workstations, continuous integration (CI) pipelines, containerized environments, and even some production services. Any system that resolved these malicious versions during the brief exposure window could have executed the payload without any overt signs of compromise.

The implications are substantial for organizations managing cloud keys, source control tokens, and secrets for AI platforms. While some credential-stealing modules within the Miasma framework were initially dormant, their presence within the distributed code meant they could be activated remotely at a later stage through established persistence channels.

AsyncAPI Malware Targets Extensive Credential Types

The Miasma runtime is equipped with extensive credential access capabilities, designed to locate and exfiltrate secrets commonly stored by developers and CI/CD systems. The malware specifically targets over a hundred environment variable names associated with various critical services.

Credential Targets

This includes tokens for source control platforms like GITHUB_TOKEN and GITLAB_TOKEN, package registry authentication such as NPM_TOKEN and NODE_AUTH_TOKEN, and credentials for major cloud providers including AWS, Azure, and Google Cloud. Furthermore, Miasma seeks out API keys for popular AI services like Anthropic and OpenAI, alongside Docker and Kubernetes tokens frequently stored in environment settings within development pipelines.

Beyond environment variables, the framework scans for sensitive files on disk, including .npmrc, AWS credentials, kubeconfig, SSH private keys, Vault tokens, .netrc, Docker configuration files, and Google service account JSON files. If a GitHub token is discovered, the malware can leverage public APIs to enumerate accessible repositories and gather CI context, mirroring tactics seen in previous npm package credential theft campaigns.

In the analyzed samples, while the harvesting modules were initially inactive, their full logic was present within the encrypted bundle. The persistence and command-and-control channels were already operational, allowing for remote activation of these modules without requiring a new package release. This pattern has been observed in earlier credential-stealing malware campaigns targeting developer tooling.

Import-Time Delivery and Pipeline Abuse

The attack chain commenced with a malicious pull request submitted to the asyncapi/generator repository. A misconfigured GitHub Actions workflow, utilizing pull_request_target, inadvertently executed untrusted code, thereby exposing a privileged bot token. Attackers then exploited this access to push malicious commits, leveraging the project’s own trusted publishing pipeline to release the malware under a legitimate npm identity.

This method of compromise aligns with other documented instances of GitHub Actions workflow abuse, where automated pipelines are weaponized to distribute malicious code. The legitimate release workflows consequently published compromised versions of @asyncapi/[email protected], [email protected], [email protected], and two versions of @asyncapi/specs, all bearing valid provenance despite originating from unauthorized source commits.

Upon a consumer importing any of these compromised packages, the embedded loader spawned a hidden Node process. This child process then retrieved an encrypted second-stage payload from IPFS, wrote a file named sync.js into an OS-specific NodeJS support directory, and activated the Miasma runtime. The primary command-and-control servers operated from a single IP address on ports 8080, 8081, and 8091, with fallback discovery mechanisms leveraging decentralized networks.

What You Should Do

• Remove and Purge: Immediately remove all affected package versions (@asyncapi/[email protected], @asyncapi/[email protected], @asyncapi/[email protected], @asyncapi/[email protected], @asyncapi/[email protected]) from your projects. Purge npm and Yarn caches to ensure no lingering malicious packages.
• Rotate Secrets: Rotate every secret, token, and credential that could have been exposed from any host or pipeline that imported the compromised packages. This includes GitHub, GitLab, npm, AWS, Azure, Google Cloud, Docker, Kubernetes, Anthropic, and OpenAI API keys.
• Scan for Indicators of Compromise (IoCs):
  • Hunt for the file sync.js in common NodeJS support directories: %LOCALAPPDATA%NodeJSsync.js (Windows), ~/.local/share/NodeJS/sync.js (Linux), ~/Library/Application Support/NodeJS/sync.js (macOS), and ~/.config/NodeJS/sync.js.
  • Look for the runtime lock file at ~/.config/.miasma/run/node.lock.
  • Monitor for unusual detached Node processes.
  • Block the following IPFS Content Identifiers (CIDs) at your perimeter if IPFS is not essential for business operations: Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf and QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9.
  • Block network traffic to the primary C2 IP address: 85.137.53[.]71 on ports 8080, 8081, and 8091.
  • Review endpoint telemetry for any presence of _miasma._tcp mDNS service discovery.
• Pin Versions: Pin known-good, uncompromised versions of dependencies in your package.json and lockfiles (e.g., package-lock.json, yarn.lock) to prevent accidental resolution of malicious versions.
• Rebuild and Harden: Rebuild shared images and golden runners from clean sources to eliminate any poisoned caches. Review and restrict GitHub Actions workflow token scopes to the principle of least privilege, particularly for workflows using pull_request_target. Update your npm CLI to the latest version.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.