Threats Tagged 'asyncapi'

Four npm packages in the AsyncAPI namespace were compromised to distribute the Miasma botnet loader. The attack used trusted GitHub Actions publishing but originated from a poisoned source commit. Malicious code injected into legitimate source files executes upon import, launching a detached Node.js process that downloads an encrypted payload from IPFS. The payload is a sophisticated tasking framework supporting multiple command-and-control channels such as REST, Nostr relays, IPFS, Ethereum smart contracts, and BitTorrent DHT. It establishes persistence on Linux via systemd services and fake NodeJS directories. The framework supports file operations, shell execution, data collection, and propagation across npm, PyPI, RubyGems, and Cargo ecosystems.

An attacker exploited a misconfigured GitHub Actions workflow in the AsyncAPI generator repository by abusing a 'pwn request' vulnerability. This led to the theft of a highly privileged Personal Access Token from the asyncapi-bot account. Using these credentials, the attacker published five malicious npm package versions under the @asyncapi namespace, which collectively have over three million weekly downloads. The malware payload executes upon import and includes multi-stage capabilities for persistence, command and control communication, and credential theft targeting browsers, SSH keys, cloud credentials, and cryptocurrency wallets. The malware shares traits with the Miasma framework but also has unique features.