Skip to main content
VulnerabilityPublished Updated

@asyncapi/specs (npm) · Malicious Code

Affects @asyncapi/specsSource GCVE Database

0
Severity
Critical

Rated by Threat Radar

Data as of 15 Jul 2026, 12:51 UTC

What to do

Affected software

ProductAffectedFixed in
npm@asyncapi/specsAffected
  • =6.8.3
  • =6.9.1
  • =6.8.2
  • =6.10.1
  • =6.11.2
  • =6.11.2-alpha.1
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

The last known safe version is 6.11.1; users should downgrade or reinstall this version. Immediate removal of the compromised package versions 6.11.2-alpha.1 and 6.11.2 is recommended. Due to the high likelihood of full system compromise, all secrets and credentials stored on affected machines should be considered compromised and rotated immediately from a separate, trusted environment. Complete system reimaging or forensic analysis is advised to ensure removal of all malicious components and persistence mechanisms. Monitor vendor advisories for any official remediation updates.

Description

The @asyncapi/specs npm package versions 6.11.2-alpha.1 and 6.11.2 were compromised as part of the Miasma RAT supply-chain attack on 2026-07-14. Malicious code was injected directly into the package's index.js, which downloads and executes a remote RAT binary from IPFS, establishing persistence and stealing sensitive credentials and secrets. The last known safe version is 6.11.1. This malicious behavior is inconsistent with the package's intended functionality and results in full system compromise upon installation or use.

References

Community reviews

Loading reviews…