Threats Tagged 'mal-2025-190636'

@asyncapi/generator versions 2.8.5, 2.8.6, and 3.3.1 were compromised in a supply-chain attack known as the "Miasma RAT" campaign. Malicious code was injected via whitespace hiding in a legitimate source file, which spawns a detached Node.js child process that downloads and executes a remote RAT binary. The malware establishes persistence by dropping a backdoor script and steals sensitive credentials and secrets including browser credentials, SSH keys, npm tokens, GitHub CLI credentials, AWS secrets, and cryptocurrency wallets. The attacker also uses a command-and-control server and an embedded Ethereum smart-contract address for potential on-chain command or data exfiltration. The last known safe version is 3.3.0. Systems with this package installed should be considered fully compromised.