Threats Tagged 'mal-2025-190657'

The @asyncapi/generator-helpers npm package version 1.1.1 was compromised in a supply-chain attack known as the "Miasma RAT" campaign. Malicious code was hidden using whitespace obfuscation and executes automatically when the package is loaded, spawning a detached Node.js process that downloads and runs a remote RAT binary. This malware establishes persistence by dropping a backdoor script and steals sensitive credentials including browser data, SSH keys, npm tokens, GitHub CLI credentials, AWS secrets, and cryptocurrency wallets. The attacker also uses a command-and-control server and an embedded Ethereum smart-contract address for potential command routing or data exfiltration. The last known safe version is 1.1.0. Other affected versions include 0.2.1 and 0.2.2. Systems with this package installed should be considered fully compromised.