The @asyncapi/generator-components npm package versions 0.3.2, 0.3.3, and 0.7.1 were compromised on 2026-07-14 as part of the "Miasma RAT" supply-chain attack (campaign "miasma-train-p1"). Malicious code was appended after trailing spaces in a legitimate source file, evading casual code review. Upon installation, the injected code spawns a detached Node.js subprocess that downloads the Miasma RAT binary from IPFS, writes it to a platform-specific location, and executes it. The RAT establishes persistence by dropping a backdoor script (sync.js) in user-specific application data directories. The malware harvests browser credentials, SSH keys, npm tokens, GitHub CLI credentials, AWS secrets, and cryptocurrency wallets, and communicates with a C2 server at IP 85.137.53.71 (Netherlands). An embedded Ethereum smart contract address suggests possible on-chain command or data exfiltration. The attack uses heavy obfuscation, runtime decoding, and stealth techniques inconsistent with legitimate package functionality. The last safe version is 0.7.0. Systems with this package installed should be considered fully compromised.

Systems with affected versions of @asyncapi/generator-components installed are at risk of full compromise. The malicious payload executes remote code, downloads and runs a RAT that steals a wide range of sensitive credentials and secrets, including browser data, SSH keys, npm tokens, GitHub CLI credentials, AWS secrets, and cryptocurrency wallets. Persistence is established, making removal difficult. The attacker gains remote control and can exfiltrate data or issue commands via a C2 server and possibly via an Ethereum smart contract. This compromises confidentiality, integrity, and availability of affected systems and data.

No official patch or fix is currently available. The last known safe version is 0.7.0; users should downgrade to this version or remove the package entirely. However, because the RAT establishes persistence and fully compromises affected systems, simply removing or downgrading the package may not fully remediate the infection. All secrets and credentials stored on compromised systems should be considered exposed and rotated immediately from a clean, uncompromised environment. Incident response should include a full system investigation and remediation. Monitor vendor advisories for updates or official fixes.