Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader

This threat involves a supply chain compromise of four npm packages within the AsyncAPI namespace. Attackers injected malicious code into legitimate source files via a poisoned source commit, abusing trusted GitHub Actions publishing workflows. When these packages are imported, the malicious code launches a detached Node.js process that downloads an 8.25 MB encrypted payload from IPFS. The final payload is a multi-stage botnet loader named Miasma, which implements a sophisticated tasking framework with multiple command-and-control channels including REST APIs, Nostr relays, IPFS, Ethereum smart contracts, and BitTorrent DHT. It achieves persistence on Linux systems through systemd services and fake NodeJS directories. The framework enables a wide range of malicious activities including file operations, shell command execution, data collection, and cross-ecosystem propagation targeting multiple package ecosystems beyond npm, such as PyPI, RubyGems, and Cargo.

The compromise allows attackers to execute arbitrary code on systems that import the affected npm packages, potentially leading to system takeover. The Miasma botnet loader supports multiple command-and-control channels, enabling resilient and flexible attacker control. Persistence mechanisms on Linux systems increase the difficulty of removal. The cross-ecosystem propagation capability increases the risk of widespread infection across multiple development environments and package managers. This can result in unauthorized data access, system manipulation, and further malware distribution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid using the compromised AsyncAPI npm packages until official guidance or patches are released. Review and verify the integrity of dependencies, especially those from the AsyncAPI namespace. Monitor for unusual Node.js processes and systemd services indicative of Miasma persistence. Consider scanning development environments and build pipelines for signs of compromise. Follow updates from AsyncAPI maintainers and trusted security sources for remediation steps.