Trojanised AsyncAPI packages slip onto npm, hitting a library downloaded 2.25 million times a week
Attackers hijacked a GitHub build pipeline on 14 July to publish five poisoned versions of AsyncAPI tools, wiring in a stealthy info-stealer that talks to its operators over Ethereum and peer-to-peer networks.
Key points
- Five malicious versions of AsyncAPI packages were published to npm on 14 July 2026 during a four-hour window between 07:10 and 11:18 UTC.
- The affected packages carry a combined weekly download count of more than 2.25 million, with @asyncapi/specs alone at 2.1 million.
- Attackers broke in through a misconfigured GitHub Actions build pipeline, not by stealing developer passwords or planting a rogue maintainer.
- The malware tried to steal credentials, browser data, crypto wallets and CI/CD secrets, but researchers at Aikido found the data-stealing routines exited before collecting anything.
- All five malicious versions have been pulled from npm, but any machine that installed them during the exposure window may still be infected.
Someone slipped booby-trapped code into a widely used developer toolkit. For a few hours on 14 July, downloading certain AsyncAPI packages from npm (the giant public library where JavaScript developers grab reusable code) meant getting a hidden info-stealer along for the ride.
AsyncAPI is a popular open-source project for describing message-based software systems, pulled down millions of times a week. That scale is why this matters.
Five poisoned versions went out under the @asyncapi name. The biggest, @asyncapi/specs, shipped as both version 6.11.2-alpha.1 and 6.11.2 and sees 2.1 million weekly downloads. Three others covered the generator toolchain at lower but still significant volumes.
How did the hackers get in?
They abused the automated build system. As Step Security put it, "the attacker pushed commits under a placeholder git identity and let each repository's real release workflow do the publishing via npm's GitHub OIDC trusted-publisher integration." No stolen password, no rogue maintainer.
That mattered because the resulting packages carried legitimate SLSA provenance attestations, a cryptographic receipt confirming the build came from an authorised pipeline. The receipt was real. The payload inside wasn't.
It's the supply-chain equivalent of a burglar getting the factory to stamp its own seal on forged goods. We covered the same GitHub Actions abuse vector in our 26 June story on the Miasma-linked Mini Shai-Hulud campaign, and the pattern keeps showing up.
What the malware actually does
The first stage is obfuscated JavaScript that runs when the poisoned package is imported. It fetches a second stage from IPFS, a peer-to-peer file network that's harder to take down than a conventional web server. That pulls a third stage: a 92,000-line malware framework, according to Wiz, that hides on the machine and phones home over HTTP, Nostr relays, Ethereum smart contracts and a libp2p mesh network.
The design is intricate. The ambitions are not original.
It hunts for credentials, authentication tokens, browser-saved passwords, secrets from build pipelines, cryptocurrency wallets and database logins. It also downloads Gitleaks and HackBrowserData to sweep for whatever it missed.
Ox Security found the malware checks whether it's running on a Russian system and quietly quits if it is. SafeDep researchers say the payload resembles a known backdoor called Miasma but suspect it's either a private fork or a copycat who adopted the name after the original source was published.
Should ordinary developers worry?
Not if you avoided those five versions. The malicious releases are gone from npm.
Installed AsyncAPI packages on 14 July and aren't certain which version you got? Treat any machine that touched those packages as suspect. Pin to known-good versions, rebuild lock files from scratch, look for a hidden file at NodeJS/sync.js, kill suspicious processes, and rotate every credential the machine could have seen. Aikido notes that although the automated theft routine crashed, an attacker with shell access could still have grabbed data by hand.
For everyone else this is a developer problem, not a consumer one. But it's another data point in a pattern Threat Vectr has now tracked across four @asyncapi stories since July, including yesterday's report on the botnet loader that rode the same namespace. The CI pipeline is the soft underbelly, and attackers know it.
