AsyncAPI Supply Chain Attack Deploys Miasma Backdoor Through Trusted npm Workflows

AsyncAPI’s npm ecosystem suffered a coordinated supply chain compromise on July 14, 2026, delivering a Miasma‑associated Node.js backdoor through trusted GitHub Actions–driven release workflows and exposing high‑value developer and CI/CD environments to remote access, credential theft, and further lateral movement.

Malicious versions were shipped for @asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, and @asyncapi/specs@6.11.2 and 6.11.2-alpha.1, together accounting for roughly 2.9 million weekly downloads.

The JavaScript backdoor was injected into runtime modules and executed when an affected package was imported, not during installation, enabling “silent” activation in builds, documentation runs, and CI/CD jobs long after dependency resolution.

Researchers note that the attacker used AsyncAPI’s own OIDC‑based trusted‑publisher workflows, producing artifacts with valid SLSA provenance attestations and making the packages appear indistinguishable from routine releases to downstream consumers.

This makes the incident a textbook example of provenance‑preserving compromise, where the pipeline is authentic. However, the commits and workflow context have already been subverted.

The AsyncAPI compromise deployed a Miasma‑associated Node.js loader that launched a detached process and pulled an encrypted second stage from IPFS, consistent with earlier Miasma waves in the npm ecosystem.

JFrog’s analysis of Miasma describes RAT‑style capabilities including persistence, remote command execution, file operations, payload updates, and flexible command‑and‑control communications.

In this campaign, the operators referenced an Ethereum smart contract that acted as an updatable configuration store, exposing alternate endpoints, Nostr relays, and BitTorrent DHT bootstrap nodes that can be rotated without republishing packages.

The codebase retains worm‑like traits, including functionality intended to help the campaign spread into additional packages, but the AsyncAPI configuration behaved primarily as a remote‑access tool rather than a fully autonomous worm in every environment.

This distinction is important for incident responders: execution and command‑and‑control activity are better indicators of compromise than download counts alone.

Cato Networks said in a report shared with GBhackers, attackers abused vulnerabilities in AsyncAPI’s GitHub Actions workflows to gain push access and publish trojanized releases under the legitimate @asyncapi namespace.

The AsyncAPI event sits on top of a broader 2026 supply chain arc involving TeamPCP, Mini Shai‑Hulud, and Miasma targeting trusted development tooling and package ecosystems.

AsyncAPI Supply Chain Attack

Earlier in March 2026, TeamPCP was linked to compromises of Trivy, the KICS GitHub Action, LiteLLM, and other CI/CD‑centric tools, focusing on already‑trusted components inside cloud and build pipelines.

By April and May, Mini Shai‑Hulud expanded across npm, PyPI, Packagist, and additional ecosystems, with the Cloud Security Alliance describing systematic harvesting of developer credentials, publishing access, and CI/CD identities.

Subsequent waves introduced Miasma into @redhat‑scoped npm packages and later adopted the Phantom Gyp technique, using malicious binding.gyp files to gain execution at install time without obvious lifecycle hooks in package.json, affecting dozens of packages and hundreds of versions.

Attribution remains murky: overlapping code, tactics, and infrastructure suggest some operational continuity, but the public availability of Mini Shai‑Hulud code means multiple actors can reuse or fork the tooling.

Cato CTRL’s supply chain intelligence agent continuously monitors security research and ecosystem disclosures, correlating affected packages, malicious versions, and infrastructure indicators.

Following the AsyncAPI reports, the agent prioritized the event for analyst review, enabling rapid validation of the Miasma command‑and‑control IP address, addition to Cato’s global blocklist, and network‑level enforcement across the Cato SASE Cloud Platform within hours.

This workflow illustrates how agentic intelligence and globally distributed controls can compress the window from disclosure to protection, even when payloads leverage resilient infrastructure like IPFS, Ethereum contracts, and BitTorrent overlays.

Organizations that may have pulled or executed affected AsyncAPI versions should treat developer workstations, CI/CD runners, documentation systems, and build environments as potentially exposed.

At a minimum, they should identify vulnerable versions in manifests and lockfiles, determine whether compromised modules were actually imported, hunt for detached Node.js processes and sync.js‑style loaders, analyze outbound connections, and rotate credentials available to those environments.

Given the campaign’s use of IPFS, BitTorrent, and pastebin‑like services, defenders should also consider policy‑driven restrictions on ipfs[.]io, BitTorrent signatures, and sites such as rentry[.]co unless required for legitimate operations.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide