Attackers Abuse GitHub Actions Workflow to Publish Provenance-Signed npm Malware

Attackers have been observed abusing GitHub Actions workflows to distribute provenance-signed malicious npm packages, marking a significant escalation in software supply chain threats.

On July 14, 2026, Microsoft Threat Intelligence uncovered a coordinated compromise of the widely used @asyncapi npm organization, where adversaries leveraged trusted CI/CD pipelines to publish backdoored packages with valid cryptographic provenance.

The attack impacted five package versions across four AsyncAPI components, including @asyncapi/specs (6.11.2-alpha.1 and 6.11.2), @asyncapi/generator@3.3.1, @asyncapi/generator-components@0.7.1, and @asyncapi/generator-helpers@1.1.1.

These packages are deeply embedded in developer workflows, often as transitive dependencies, significantly expanding the blast radius across developer machines, CI/CD pipelines, and production systems.

Unlike traditional npm supply chain attacks that rely on lifecycle hooks such as postinstall, this campaign executed malicious code at module import time.

This technique bypasses common mitigations like npm install –ignore-scripts, as the payload is triggered during runtime when the compromised module is imported.

The intrusion originated from a malicious pull request targeting the asyncapi/generator repository.

A misconfigured GitHub Actions workflow using pull_request_target allowed attacker-controlled code to execute within a privileged context.

This led to exposure of a personal access token associated with asyncapi-bot, enabling unauthorized commits to release branches.

These packages were published under npm-oidc-no-reply@github.com and included valid provenance attestations, making them indistinguishable from legitimate releases at a cryptographic level.

This technique mirrors emerging risks documented in software supply chain frameworks such as SLSA (Supply-chain Levels for Software Artifacts), where provenance integrity can be undermined if upstream CI/CD pipelines are compromised.

Microsoft Threat Intelligence identified that, the attackers then abused GitHub’s OpenID Connect (OIDC) trusted publishing mechanism to release malicious packages via legitimate workflows such as release-with-changesets.yml and if-nodejs-release.yml.

GitHub Actions Abused

The injected payload deployed a sophisticated multi-stage malware framework known as Miasma. Execution begins immediately upon import, spawning a detached Node.js process that retrieves a secondary payload (sync.js) from IPFS using hardcoded content identifiers.

The second-stage payload is heavily obfuscated and encrypted using layered cryptographic routines including HKDF-SHA256 and AES-256-GCM.

Once decrypted, it initializes the Miasma runtime (identified as M-RED-TEAM v6.4), which supports command-and-control communication, persistence mechanisms, and decentralized fallback channels leveraging IPFS, Nostr, Ethereum, and BitTorrent DHT.

Although several high-risk capabilities such as credential harvesting and lateral propagation were turned off in this campaign, the framework includes modules capable of extracting sensitive data from environment variables, cloud credentials, and developer tooling, aligning with tactics mapped.

Microsoft Defender detects the malicious components as Trojan: JS/MiasmStealer.SC and Trojan:Script/Supychain.A, with behavioral detections covering suspicious Node.js child processes, persistence artifacts, and outbound C2 communications to 85.137.53.71 across ports 8080, 8081, and 8091.

Organizations are advised to immediately remove affected versions, including transitive dependencies, and revert to safe versions such as @asyncapi/specs 6.11.1 and @asyncapi/generator 3.3.0.

Additional remediation steps include purging npm and Yarn caches, hunting for sync.js within OS-specific NodeJS directories, and rotating all credentials accessible to compromised environments.

Security teams should also review GitHub Actions configurations, specifically avoiding unsafe use of pull_request_target with untrusted code, and enforce least-privilege access controls for tokens and secrets.

This incident highlights a critical shift in attacker strategy, where trusted CI/CD pipelines and signed artifacts are weaponized against downstream consumers.

Similar supply chain compromises, such as the 2024 XZ Utils backdoor and ongoing dependency confusion campaigns, reinforce the need for runtime behavioral monitoring in addition to build-time integrity checks.

As attackers increasingly exploit trusted automation and decentralized infrastructure like IPFS, defenders must evolve beyond signature-based controls and adopt holistic supply chain security practices that encompass pipeline hardening, artifact verification, and runtime anomaly detection.

Indicators of compromise

Package	Version	Injected file	Tarball SHA-256
@asyncapi/specs	6.11.2-alpha.1	index.js	d425e4583cc6185d41e95c45eda00550045a5d1919b9a012236a4520d009dbd7
@asyncapi/specs	6.11.2	index.js	9b2e65db653ca8575c9b10eefb9a80c6006404812c2ec212bf5675e3c690233b
@asyncapi/generator	3.3.1	lib/templates/config/validator.js	bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4
@asyncapi/generator-components	0.7.1	lib/utils/ErrorHandling.js	082d733db0687dcd768104972b065d4b58cb1e6043688c6c20fa3702337f36ab

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist