The @asyncapi/specs package versions 6.11.2-alpha.1 and 6.11.2 were maliciously altered in a supply-chain attack known as the Miasma RAT campaign. The attacker prepended obfuscated malicious code to index.js that, when the package is loaded, spawns a detached child process to download a RAT binary from an IPFS gateway. This RAT is written to a platform-specific hidden directory and executed, establishing persistence via a backdoor named sync.js. The RAT harvests browser credentials, SSH keys, npm tokens, GitHub CLI credentials, AWS secrets, and cryptocurrency wallets, and communicates with a command-and-control server in the Netherlands. The attack also embeds an Ethereum smart-contract address, suggesting on-chain command or data exfiltration. The last safe version before compromise is 6.11.1. The package's legitimate functionality does not require such code, indicating malicious intent. Removal of the package alone may not fully remediate the infection due to established persistence and potential full system compromise.

Systems with the compromised @asyncapi/specs versions installed or running are considered fully compromised. The malicious code enables remote code execution, persistence, and credential theft including sensitive tokens and keys for various services and wallets. This can lead to unauthorized access to cloud accounts, source code repositories, cryptocurrency theft, and further propagation of the malware. The attacker gains full control over the infected system and can exfiltrate data or execute arbitrary commands remotely.

No official patch or fix is currently documented for the compromised versions. The last known safe version is 6.11.1; users should downgrade or reinstall this version. Immediate removal of the compromised package versions 6.11.2-alpha.1 and 6.11.2 is recommended. Due to the high likelihood of full system compromise, all secrets and credentials stored on affected machines should be considered compromised and rotated immediately from a separate, trusted environment. Complete system reimaging or forensic analysis is advised to ensure removal of all malicious components and persistence mechanisms. Monitor vendor advisories for any official remediation updates.