@asyncapi/generator-helpers (npm) · Malicious Code
Affects @asyncapi/generator-helpersSource GCVE Database
Rated by Threat Radar
Data as of 15 Jul 2026, 12:51 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@asyncapi/generator-helpers | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
The last known safe version is 1.1.0. Users should immediately remove all affected versions (=0.2.1, =0.2.2, =1.1.1) of @asyncapi/generator-helpers from their environments. Because the malware establishes persistence and steals credentials, all secrets, tokens, and keys stored on compromised systems should be considered exposed and rotated immediately from a clean, uncompromised device. Full system compromise is likely, so affected hosts should be thoroughly investigated and potentially rebuilt. Users should also audit their GitHub repositories and npm packages for signs of further compromise or propagation. No cloud service remediation applies as this is a client-side npm package compromise.
Description
The @asyncapi/generator-helpers npm package version 1.1.1 was compromised in a supply-chain attack known as the "Miasma RAT" campaign. Malicious code was hidden using whitespace obfuscation and executes automatically when the package is loaded, spawning a detached Node.js process that downloads and runs a remote RAT binary. This malware establishes persistence by dropping a backdoor script and steals sensitive credentials including browser data, SSH keys, npm tokens, GitHub CLI credentials, AWS secrets, and cryptocurrency wallets. The attacker also uses a command-and-control server and an embedded Ethereum smart-contract address for potential command routing or data exfiltration. The last known safe version is 1.1.0. Other affected versions include 0.2.1 and 0.2.2. Systems with this package installed should be considered fully compromised.
References
- github.com/advisories/GHSA-gw3q-hxvp-x7vm (opens in a new tab)
- aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains (opens in a new tab)
- wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack (opens in a new tab)
- stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised (opens in a new tab)
- npmjs.com/package/@asyncapi/generator-helpers/v/1.1.1 (opens in a new tab)
- safedep.io/asyncapi-generator-supply-chain-attack-miasma-rat/ (opens in a new tab)
- github.com/asyncapi/generator/issues/2184 (opens in a new tab)