On July 14, 2026, a supply chain compromise occurred via a misconfigured GitHub Actions workflow in the AsyncAPI generator repository. The attacker exploited a 'pwn request' vulnerability to open multiple pull requests, one of which contained obfuscated JavaScript that exfiltrated a privileged Personal Access Token belonging to asyncapi-bot. With the stolen token, the attacker published five malicious npm package versions under the @asyncapi namespace. These packages, downloaded millions of times weekly, contain a multi-stage malware payload that activates on import, establishes persistence, connects to command and control infrastructure, and steals various credentials including browser data, SSH keys, cloud credentials, and cryptocurrency wallets. The malware shows technical similarities to the Miasma malware framework but includes a comprehensive and unique command framework.

The compromise allows attackers to distribute malware through widely used npm packages under the trusted @asyncapi namespace, potentially affecting millions of users. The malware's capabilities include credential theft across multiple sensitive areas (browsers, SSH, cloud, crypto wallets), persistence on infected systems, and remote command and control, posing significant risks to confidentiality and system integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations using packages from the @asyncapi namespace should verify the integrity and authenticity of their dependencies. Review and secure GitHub Actions workflows to prevent unauthorized token exposure, especially by restricting pull request workflows and limiting token permissions. Rotate any exposed Personal Access Tokens immediately and audit for suspicious activity. Monitor for and remove any malicious package versions if detected.