Threats Tagged 'pwn request'

An attacker exploited a misconfigured GitHub Actions workflow in the AsyncAPI generator repository by abusing a 'pwn request' vulnerability. This led to the theft of a highly privileged Personal Access Token from the asyncapi-bot account. Using these credentials, the attacker published five malicious npm package versions under the @asyncapi namespace, which collectively have over three million weekly downloads. The malware payload executes upon import and includes multi-stage capabilities for persistence, command and control communication, and credential theft targeting browsers, SSH keys, cloud credentials, and cryptocurrency wallets. The malware shares traits with the Miasma framework but also has unique features.