The Miasma v3 worm compromised four AsyncAPI npm packages (@asyncapi/generator, @asyncapi/generator-helpers, @asyncapi/generator-components, and @asyncapi/specs) by exploiting an unauthorized commit to the repository's release branch. The attacker leveraged the legitimate GitHub Actions workflow with npm's OIDC integration to publish malicious package versions that carried valid provenance attestations, bypassing typical supply chain trust mechanisms. Unlike earlier Miasma variants that triggered on installation, this version activates when the poisoned library is loaded by an application. Upon activation, it downloads a second-stage payload from the InterPlanetary File System (IPFS), establishing a persistent Node.js backdoor capable of executing arbitrary shell commands. While the malware includes capabilities for credential theft, lateral movement, and AI-tool poisoning, this deployment primarily functions as a remote access trojan. The incident highlights the critical importance of enforcing branch protection controls and reviewing CI/CD workflows to prevent unauthorized changes, as reliance on provenance attestations alone is insufficient to prevent supply chain compromises.

Systems that load the compromised AsyncAPI npm packages risk having a persistent backdoor installed, allowing attackers to execute arbitrary shell commands remotely. This can lead to unauthorized remote access, potential credential theft, lateral movement within networks, and further compromise of affected environments. The attack undermines trust in the software supply chain by abusing legitimate publishing workflows and valid provenance attestations. Although no active exploitation in the wild has been reported, the malware's advanced capabilities pose a significant potential risk if leveraged by threat actors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should verify the integrity of AsyncAPI npm packages before use and monitor for official updates or patches from AsyncAPI. Enforcing strict branch protection on release branches and auditing CI/CD workflows for unauthorized commits are critical to prevent similar supply chain attacks. Since this attack abuses legitimate publishing workflows and provenance attestations, additional controls beyond provenance verification are necessary to secure the software supply chain.