This threat involves a supply-chain attack on the AsyncAPI npm packages where an attacker compromised two AsyncAPI GitHub repositories by exploiting a misconfigured GitHub Actions CI/CD pipeline. The attacker pushed commits under a placeholder identity, allowing the legitimate release workflows to publish trojanized packages with valid SLSA provenance attestations. The infected packages include @asyncapi/generator 3.3.1, @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, and @asyncapi/specs 6.11.2-alpha.1 and 6.11.2. The malware is a multi-stage remote access trojan that downloads a large modular malware framework from IPFS, establishes persistence, and communicates with C2 servers via HTTP, Nostr relays, Ethereum smart contracts, and libp2p mesh networks. Its primary purpose is stealing credentials, authentication keys, tokens, browser data, CI/CD secrets, cryptocurrency wallets, and databases. Some automated data harvesting functions are non-functional, but manual exploitation is possible. The malware avoids infecting systems in Russia. The malicious packages have been removed from npm, but residual risk remains from existing installations and lock files created during the exposure window of about four hours on July 14, 2026.

The attack compromises the integrity of AsyncAPI npm packages by injecting a remote access trojan capable of stealing sensitive information such as credentials, authentication tokens, browser data, CI/CD secrets, cryptocurrency wallets, and databases. The malware establishes persistence and communicates with multiple command-and-control channels, enabling ongoing unauthorized access and data exfiltration. Although some automated data collection features are reportedly non-functional, attackers can manually leverage the shell to harvest data. The presence of malicious versions in existing installations and lock files poses a continued risk until remediated.

All five malicious package versions have been removed from npm. Developers should pin dependencies to known-good versions and regenerate lock files to avoid installing the trojanized packages. It is critical to remove the hidden malicious payload file 'NodeJS/sync.js' from affected systems, terminate any running malicious processes, and rotate all credentials and secrets that may have been exposed. These steps address the residual risk from the exposure window between 07:10 and 11:18 UTC on July 14, 2026. No official patch is applicable since this is a supply-chain compromise; remediation depends on cleaning affected environments and updating dependencies.