This supply chain attack on the @asyncapi npm organization originated from a vulnerability in a GitHub Actions workflow that leaked privileged credentials. Attackers injected malicious code into five package versions across four packages. Unlike typical postinstall script attacks, this campaign executes payloads at module import time, circumventing npm install --ignore-scripts defenses. The malicious code spawns hidden processes that retrieve a second-stage payload from IPFS, deploying the Miasma modular runtime. This runtime includes command-and-control functionality, persistence mechanisms, and credential harvesting. The payload also contains disabled modules for supply chain propagation, AI-tool poisoning, and sandbox evasion. The compromised packages were released using legitimate GitHub OIDC workflows with valid provenance signatures, making detection difficult within trusted release pipelines. No known exploits in the wild have been reported yet.

The attack compromises the integrity of npm packages from the @asyncapi organization, potentially allowing attackers to execute arbitrary code at module import time in dependent projects. This can lead to unauthorized command-and-control, persistence on affected systems, and credential harvesting. The use of valid provenance signatures and legitimate GitHub OIDC workflows increases the difficulty of detecting the compromise. The import-time execution bypasses common npm install script protections, increasing the risk of unnoticed infection in development and production environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or guidance are available, users should audit dependencies from the @asyncapi npm organization carefully. Consider temporarily avoiding affected packages or versions if identified. Monitor official vendor and security advisories for updates on remediation and patches. Since the attack leverages GitHub Actions workflow vulnerabilities, review and secure CI/CD workflows to prevent credential exposure. Employ supply chain security best practices such as verifying package provenance and using tools that detect malicious code at import time.