@asyncapi/generator versions =2.8.5, =2.8.6, and =3.3.1 were compromised on 2026-07-14 as part of the "Miasma RAT" supply-chain attack. The malicious code was stealthily injected into the lib/templates/config/validator.js file using whitespace hiding and obfuscated JavaScript string arrays. Upon loading, the injected code spawns a detached Node.js child process that downloads the Miasma RAT binary from IPFS, writes it to a platform-specific location, and executes it. The RAT establishes persistence by dropping a backdoor script named sync.js in user-specific application data directories. It harvests a wide range of sensitive credentials and secrets and communicates with a command-and-control server hosted in the Netherlands. An Ethereum smart-contract address is embedded, suggesting advanced on-chain command or exfiltration mechanisms. The malicious commit was pushed to the repository's next branch and is inconsistent with legitimate maintainer activity. The last safe version is 3.3.0. Removal of the package alone does not guarantee system cleanup due to the persistence and credential theft capabilities.

Systems with affected versions of @asyncapi/generator installed are fully compromised. The malicious code executes with user privileges, downloads and runs a remote RAT, and establishes persistence. Sensitive credentials and secrets including browser credentials, SSH keys, npm tokens, GitHub CLI credentials, AWS secrets, and cryptocurrency wallets may be stolen. The attacker gains remote control via a command-and-control server and may leverage an Ethereum smart-contract for command or data exfiltration. The compromise enables extensive unauthorized access and potential further propagation. Removal of the package does not guarantee removal of all malicious artifacts or attacker access.

The last known safe version is 3.3.0. Users should immediately remove affected versions (=2.8.5, =2.8.6, =3.3.1) of @asyncapi/generator from their systems. Given the full compromise risk, all secrets, credentials, and keys stored on affected machines must be rotated from a separate, trusted environment. Because the malware establishes persistence and may have caused further system compromise, a full system forensic analysis and remediation is recommended. There is no official patch or fix beyond upgrading to a safe version. Users should monitor vendor advisories for updates. Removal of the package alone is insufficient to ensure system integrity.