The @asyncapi/specs npm package versions 6.11.2-alpha.1 and 6.11.2 were compromised as part of the Miasma RAT supply-chain attack on 2026-07-14. Malicious code was injected directly into the package's index.js, which downloads and executes a remote RAT binary from IPFS, establishing persistence and stealing sensitive credentials and secrets. The last known safe version is 6.11.1. This malicious behavior is inconsistent with the package's intended functionality and results in full system compromise upon installation or use.