Skip to main content
VulnerabilityPublished Updated

@asyncapi/generator (npm) · Malicious Code

Affects @asyncapi/generatorSource GCVE Database

0
Severity
Critical

Rated by Threat Radar

Data as of 15 Jul 2026, 12:51 UTC

What to do

Affected software

ProductAffectedFixed in
npm@asyncapi/generatorAffected
  • =2.8.6
  • =2.8.5
  • =3.3.1
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

The last known safe version is 3.3.0. Users should immediately remove affected versions (=2.8.5, =2.8.6, =3.3.1) of @asyncapi/generator from their systems. Given the full compromise risk, all secrets, credentials, and keys stored on affected machines must be rotated from a separate, trusted environment. Because the malware establishes persistence and may have caused further system compromise, a full system forensic analysis and remediation is recommended. Users should monitor vendor advisories for updates. Removal of the package alone is insufficient to ensure system integrity.

Description

@asyncapi/generator versions 2.8.5, 2.8.6, and 3.3.1 were compromised in a supply-chain attack known as the "Miasma RAT" campaign. Malicious code was injected via whitespace hiding in a legitimate source file, which spawns a detached Node.js child process that downloads and executes a remote RAT binary. The malware establishes persistence by dropping a backdoor script and steals sensitive credentials and secrets including browser credentials, SSH keys, npm tokens, GitHub CLI credentials, AWS secrets, and cryptocurrency wallets. The attacker also uses a command-and-control server and an embedded Ethereum smart-contract address for potential on-chain command or data exfiltration. The last known safe version is 3.3.0. Systems with this package installed should be considered fully compromised.

References

Community reviews

Loading reviews…