@asyncapi/generator-components (npm) · Malicious Code
Affects @asyncapi/generator-componentsSource GCVE Database
Malicious package : remove @asyncapi/generator-components and rotate any secrets on hosts that installed it.
Data as of 15 Jul 2026, 12:51 UTC
Malicious package
Published to npm · OSV MAL-2025-190656
What to do
Remove @asyncapi/generator-components from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@asyncapi/generator-components | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
@asyncapi/generator-components version 0.7.1 and earlier versions 0.3.2 and 0.3.3 were compromised in a supply-chain attack known as the "Miasma RAT" campaign. Malicious code was hidden using whitespace obfuscation and executed on package installation, downloading and running a remote access trojan (Miasma RAT). This malware steals sensitive credentials and secrets, establishes persistence, and communicates with a command-and-control server. The last known safe version is 0.7.0. Removal of the package alone may not fully remediate the compromise due to persistence mechanisms.
References
- github.com/advisories/GHSA-m6ch-4fxh-v72c (opens in a new tab)
- aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains (opens in a new tab)
- wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack (opens in a new tab)
- stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised (opens in a new tab)
- npmjs.com/package/@asyncapi/generator-components/v/0.7.1 (opens in a new tab)
- safedep.io/asyncapi-generator-supply-chain-attack-miasma-rat/ (opens in a new tab)
- github.com/asyncapi/generator/issues/2184 (opens in a new tab)