Critical GitHub Actions Flaw Backdoors AsyncAPI npm Packages with Miasma RAT

Key Takeaways

• A sophisticated supply chain attack has infected several AsyncAPI npm packages with Miasma RAT.
• The attack leveraged a critical GitHub Actions vulnerability, allowing malicious code to be published through legitimate channels.
• Affected packages include @asyncapi/generator (v3.3.1), @asyncapi/generator-helpers (v1.1.1), @asyncapi/generator-components (v0.7.1), and @asyncapi/specs (v6.11.2-alpha.1, v6.11.2).
• The Miasma RAT employs stealthy execution, activating upon module import rather than installation, and uses an Ethereum contract for C2 fallback.
• Organizations are urged to review dependencies, scan for indicators of compromise, and secure GitHub Actions workflows.

A significant supply chain attack has compromised several trusted AsyncAPI npm packages, embedding the Miasma remote access Trojan (RAT) within them. This incident poses a substantial risk to developer workstations and automated build environments, which frequently handle sensitive credentials.

Attackers exploited a vulnerability in the release process of the AsyncAPI project, enabling them to distribute malicious code under the project’s official npm namespace. This method bypasses typical security measures, as the packages appear to originate from a legitimate source.

The affected packages collectively account for approximately 2.9 million weekly downloads. While this figure doesn’t directly translate to confirmed infections, it highlights the broad potential impact of the attack. The concern is amplified by the fact that these developer tools often operate within critical environments like CI/CD pipelines, documentation systems, and development setups, all of which are repositories for valuable credentials and intellectual property.

Researchers at Cato Networks, who uncovered this activity through their supply chain intelligence monitoring, detailed the attackers’ sophisticated technique. They observed that the threat actors utilized a legitimate software release pathway to deploy a Node.js payload associated with Miasma. This incident underscores a growing challenge in software supply chain security: the inherent trust placed in official package names and established publishing workflows is no longer sufficient to guarantee safety.

Hackers Exploit GitHub Actions Vulnerability

The attack originated from a misconfigured GitHub Actions workflow. This configuration permitted untrusted content from pull requests to interact with a privileged workflow context. This critical flaw provided the attackers with a vector to either compromise or misuse an AsyncAPI automation identity, subsequently allowing them to make unauthorized modifications to the repository.

The malicious alterations were subtly introduced into a branch linked to the project’s release pipeline, designed to mimic routine development activities. Consequently, AsyncAPI’s automated publishing system then released these tampered packages, lending them an air of legitimacy due to their origin within the expected npm namespace.

This sophisticated approach differentiates the attack from simpler typosquatting schemes, where threat actors publish malicious lookalike packages from unofficial accounts. Instead, it mirrors the dangers highlighted in previous GitHub Actions workflow attacks, where inadequate handling of untrusted pull request data can expose sensitive tokens and cloud credentials. The compromised packages include @asyncapi/generator version 3.3.1, @asyncapi/generator-helpers version 1.1.1, @asyncapi/generator-components version 0.7.1, and @asyncapi/specs versions 6.11.2-alpha.1 and 6.11.2. Development teams that automatically fetched dependencies during the exposure period might have inadvertently integrated the malicious code into their build environments.

Miasma’s Stealthy Execution Techniques

The Miasma malware’s injected JavaScript payload was designed to evade detection by not relying on conventional npm lifecycle scripts, such as postinstall. Instead, the malware activates only when an affected module is imported. This allows the malicious code to remain dormant after installation, executing later during critical phases like application builds, runtime, documentation generation, or CI/CD jobs, thereby enhancing its stealth and persistence.

Upon execution, the initial stage of the malware launches a detached Node.js process. This process then downloads an encrypted second-stage payload from the InterPlanetary File System (IPFS). According to researchers, this advanced payload grants attackers capabilities such as maintaining persistent access, executing remote commands, manipulating files, self-updating, and communicating with their command-and-control (C2) infrastructure. This strategy aligns with a broader trend in npm attacks that deliberately avoid easily detectable installation hooks, similar to past campaigns that used malicious binding.gyp package files to bypass checks focused on standard package scripts.

Notably, Miasma incorporates an Ethereum contract as a fallback mechanism for its C2 configuration. This contract stores crucial information, including alternative endpoints, relay details, and bootstrap data. The specific configuration analyzed by researchers indicated that the malware primarily functioned as a remote-access tool. Therefore, it was characterized as a Miasma-associated RAT, rather than presuming its automatic propagation across all affected environments.

What You Should Do

• Audit Dependencies: Immediately review project manifests, lockfiles, caches, and build artifacts for the presence of the identified malicious versions: @asyncapi/generator (3.3.1), @asyncapi/generator-helpers (1.1.1), @asyncapi/generator-components (0.7.1), and @asyncapi/specs (6.11.2-alpha.1, 6.11.2).
• Scan for IoCs: Actively search for the payload filename NodeJSsync.js within your systems.
• Monitor Network Activity: Scrutinize outbound network connections for communications with ipfs[.]io, rentry[.]co, and any suspicious BitTorrent-related network signatures (e.g., cidheurbittorrent, cidheurbittorrent1 through cidheurbittorrent5).
• Review Repository Logs: Examine GitHub repository logs for unauthorized changes or suspicious activity, particularly around the time the malicious packages were published.
• Rotate Credentials: Rotate any credentials, tokens, or secrets that were accessible to affected developer workstations or CI/CD environments.
• Harden GitHub Actions: Reconfigure privileged GitHub Actions workflows, especially those utilizing pull_request_target, to prevent untrusted pull request content from interacting with sensitive contexts. Implement stricter input validation and least privilege principles.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.