@asyncapi/generator-helpers version 1.1.1 was trojanized as part of the "Miasma RAT" supply-chain attack on 2026-07-14. The malicious code was appended invisibly via trailing whitespace in a legitimate source file, executing an obfuscated payload at module load. This payload spawns a detached child Node.js process that downloads the Miasma RAT binary from IPFS, writes it to a platform-specific location, and executes it. The RAT establishes persistence by dropping a backdoor script named sync.js in user-specific application data directories. It harvests a wide range of sensitive credentials and secrets, including browser credentials, SSH keys, npm tokens, GitHub CLI credentials, AWS secrets, and cryptocurrency wallets. Communication with a command-and-control server in the Netherlands is established, and an Ethereum smart-contract address is embedded, suggesting advanced exfiltration or command mechanisms. The attack is linked to the Sha1-Hulud NPM worm, which also propagates via GitHub actions and may destroy user data. The last safe version is 1.1.0; versions 0.2.1, 0.2.2, and 1.1.1 are affected.

Any system with the affected versions of @asyncapi/generator-helpers installed is fully compromised. The malicious code executes automatically upon package load, allowing remote attackers to run arbitrary code via the Miasma RAT. This RAT steals a broad range of sensitive credentials and secrets, including browser data, SSH keys, npm tokens, GitHub CLI credentials, AWS secrets, and cryptocurrency wallets. Persistence is established on the host, enabling ongoing unauthorized access. The attacker controls the infected system via a command-and-control server and may use an Ethereum smart-contract for command or data exfiltration. The compromise may also lead to destruction of user data and propagation of the malware to other npm packages and GitHub repositories owned by the victim.

The last known safe version is 1.1.0. Users should immediately remove all affected versions (=0.2.1, =0.2.2, =1.1.1) of @asyncapi/generator-helpers from their environments. Because the malware establishes persistence and steals credentials, all secrets, tokens, and keys stored on compromised systems should be considered exposed and rotated immediately from a clean, uncompromised device. Full system compromise is likely, so affected hosts should be thoroughly investigated and potentially rebuilt. There is no official patch or fix beyond upgrading to a safe version. Users should also audit their GitHub repositories and npm packages for signs of further compromise or propagation. No cloud service remediation applies as this is a client-side npm package compromise.