{
  "campaign": {
    "name": "miasma-train-p1",
    "slug": "miasma-train-p1",
    "href": "/ti/campaigns/miasma-train-p1",
    "description": "Supply chain compromise of AsyncAPI npm packages (2026-07-14) that delivered a staged, IPFS-hosted, multi-channel-C2 credential-stealing Trojan framework. Initial access: on 2026-07-14 an attacker opened 37 pull requests to asyncapi/generator; 36 were decoys adding a fake charity donation page, one exploited a misconfigured GitHub Actions workflow (.github/workflows/manual-netlify-preview.yml — a pull_request_target 'pwn request' that checked out PR code instead of the base branch) to steal the org-wide Personal Access Token of the asyncapi-bot service account (PR #2155 at 05:08 UTC; malicious run completed 05:16 UTC before automated review flagged the obfuscation and blocked merge). The stolen PAT was used to push a malicious commit (3eab3ec9304aa26081358330491d3cfeb55cc245, 'fix: test release workflow on next') to the next branch of asyncapi/generator at 06:58 UTC, triggering the release workflow to publish 3 compromised npm packages at 07:10 UTC; the attacker then pushed 11 commits to asyncapi/spec-json-schemas (07:51-08:28 UTC) publishing 2 more versions of @asyncapi/specs. The vulnerability class was known: PoC in asyncapi/generator PR #2078 (Apr 29) and a proposed fix in PR #2092 (May 17) that was still unmerged 58 days later. Payload self-identifies as campaign 'miasma-train-p1' (SafeDep first-party) and as 'M-RED-TEAM v6.4' in code comments (Wiz). ATTRIBUTION IS UNRESOLVED and BOTH sources decline it: the javascript-obfuscator custom-base64 config, giteaPackagesOrg='miasma-test-org', persistence service 'miasma-monitor.service', and miasma-branded Nostr tags echo the Miasma framework, WHILE the rentry.co dead-drop slug 'elzotebo' matches the separate 'prt-scan' campaign (which Wiz states is NOT linked to Miasma). The payload is a ground-up rewrite (vanilla Node.js not Bun; secp256k1 + AES-256-GCM + HKDF; ChannelOrchestrator C2 over HTTP/Nostr/Ethereum/IPFS/BitTorrent-DHT/libp2p) with minimal resemblance to prior Miasma and Shai-Hulud worm payloads. Treat any link to Miasma: The Spreading Blight as LOW CONFIDENCE (shared brand strings + obfuscation config only). Combined ~2.9M weekly downloads across the compromised packages; payload executes on import/require, not on install.",
    "objective": "Credential harvesting (browser passwords/cookies, SSH keys, npm/GitHub/AWS tokens, macOS Keychain, crypto wallets) and modular RAT command-and-control, with dormant worm-propagation capability.",
    "aliases": [
      "M-Red-Team",
      "M-RED-TEAM v6.4",
      "Miasma RAT (AsyncAPI)"
    ],
    "discovered_at": "2026-07-14"
  },
  "packages": [
    {
      "ecosystem": "npm",
      "name": "@asyncapi/generator",
      "href": "/ti/packages/npm/@asyncapi/generator",
      "threat_types": [
        "credential_stealer",
        "rat",
        "c2_agent",
        "data_exfiltration",
        "persistence"
      ],
      "versions": [
        "3.3.1"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "@asyncapi/generator-helpers",
      "href": "/ti/packages/npm/@asyncapi/generator-helpers",
      "threat_types": [
        "credential_stealer",
        "rat",
        "c2_agent",
        "data_exfiltration",
        "persistence"
      ],
      "versions": [
        "1.1.1"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "@asyncapi/generator-components",
      "href": "/ti/packages/npm/@asyncapi/generator-components",
      "threat_types": [
        "credential_stealer",
        "rat",
        "c2_agent",
        "data_exfiltration",
        "persistence"
      ],
      "versions": [
        "0.7.1"
      ]
    },
    {
      "ecosystem": "npm",
      "name": "@asyncapi/specs",
      "href": "/ti/packages/npm/@asyncapi/specs",
      "threat_types": [
        "credential_stealer",
        "data_exfiltration",
        "worm",
        "persistence"
      ],
      "versions": [
        "6.8.2",
        "6.9.1",
        "6.11.2",
        "6.11.2-alpha.1"
      ]
    }
  ],
  "indicators": [
    {
      "kind": "ipv4",
      "value": "85.137.53.71",
      "href": "/ti/ioc/ipv4/85.137.53.71",
      "context": "Primary HTTP C2 server. Command server on port 8080, data-exfiltration upload on port 8081 (SafeDep also observed proxy management on 8091). Attacker secp256k1 public key from the decrypted __RT_BAKED__ config: 0432fa4ba871877d94081fe83323fa24dfa1491e9de8725cbab7b734de9e9be3b233ef6742fd6264437c9532223d687b05fa540b70af6a516b8539af84d0eeb48e (beacon signing / encrypted C2)."
    },
    {
      "kind": "wallet",
      "value": "0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710",
      "href": "/ti/ioc/wallet/0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710",
      "context": "Ethereum mainnet smart contract used as fallback C2 channel for address refresh / payload updates. Queried via public RPC (ethereum-rpc.publicnode.com)."
    },
    {
      "kind": "wallet",
      "value": "0x1969ab05d67b67fdcaa26240f738ccb077e1cd84",
      "href": "/ti/ioc/wallet/0x1969ab05d67b67fdcaa26240f738ccb077e1cd84",
      "context": "Ethereum backup C2 contract (Wiz IOC table)."
    },
    {
      "kind": "wallet",
      "value": "0x92d4C5413e4F7B258a114964101F9e1C6d64C6Ba",
      "href": "/ti/ioc/wallet/0x92d4C5413e4F7B258a114964101F9e1C6d64C6Ba",
      "context": "Ethereum deployer wallet for the C2 contracts (Wiz IOC table)."
    },
    {
      "kind": "domain",
      "value": "relay.damus.io",
      "href": "/ti/ioc/domain/relay.damus.io",
      "context": "Nostr relay used as a fallback C2 channel (miasma-branded tags). From decrypted config nostrRelays array."
    },
    {
      "kind": "domain",
      "value": "relay.nostr.com",
      "href": "/ti/ioc/domain/relay.nostr.com",
      "context": "Nostr relay used as a fallback C2 channel. From decrypted config nostrRelays array."
    },
    {
      "kind": "domain",
      "value": "ipfs.io",
      "href": "/ti/ioc/domain/ipfs.io",
      "context": "IPFS gateway used for Stage-2 payload delivery."
    },
    {
      "kind": "url",
      "value": "ipfs://QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9",
      "href": "/ti/ioc/url/url-53699d3467e8",
      "context": "IPFS CID for the Stage-2 RAT payload delivered to the three generator packages. 8.25 MB AES-256-GCM encrypted JavaScript. SHA-256 of the downloaded file: 24b9ee242f21a73b55f7bb3297eafb33c60840907386b542ed79fc6b72365168."
    },
    {
      "kind": "url",
      "value": "ipfs://Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf",
      "href": "/ti/ioc/url/url-337223c7cb7f",
      "context": "IPFS CID for the Stage-2 RAT payload delivered to @asyncapi/specs. 8.24 MB AES-256-GCM encrypted JavaScript. SHA-256 of downloaded file: e9544a648d8fbaccd01b8477cf68471d48b89bf93eeacbdf5bba20fd296ff7b5. Wiz labels this the 'react-sdk variant'."
    },
    {
      "kind": "domain",
      "value": "rentry.co",
      "href": "/ti/ioc/domain/rentry.co",
      "context": "Dead-drop used to exfiltrate the stolen asyncapi-bot PAT from the GitHub Actions runner. Slug 'elzotebo' matches naming patterns of the separate 'prt-scan' campaign (per Wiz, prt-scan is NOT linked to Miasma)."
    },
    {
      "kind": "sha1",
      "value": "c8cb3f6d5b90c46686d2bf531dc1a5786e27edc5",
      "href": "/ti/ioc/sha1/c8cb3f6d5b90c46686d2bf531dc1a5786e27edc5",
      "context": "sync.js Stage-2 persisted payload (Wiz IOC table)."
    },
    {
      "kind": "github_repo",
      "value": "asyncapi/generator",
      "href": "/ti/ioc/github_repo/github_repo-899726f07a5f",
      "context": "Entry-point repository. Vulnerable workflow .github/workflows/manual-netlify-preview.yml (pull_request_target pwn request). Malicious PR #2155; malicious commit 3eab3ec9304aa26081358330491d3cfeb55cc245 pushed to the next branch at 06:58 UTC (unsigned, placeholder git author 'Your Name <you@example.com>'). Prior PoC #2078 / unmerged fix #2092."
    },
    {
      "kind": "github_repo",
      "value": "asyncapi/spec-json-schemas",
      "href": "/ti/ioc/github_repo/github_repo-b5fff4b357e1",
      "context": "Second repository pivoted to with the stolen asyncapi-bot PAT (11 commits, 07:51-08:28 UTC) to publish @asyncapi/specs 6.11.2 and 6.11.2-alpha.1."
    },
    {
      "kind": "sha1",
      "value": "22bf76fe317ea6769bd38619bd440e42d119bd6b",
      "href": "/ti/ioc/sha1/22bf76fe317ea6769bd38619bd440e42d119bd6b",
      "context": "Malicious validator.js in @asyncapi/generator (Wiz IOC table)."
    },
    {
      "kind": "sha1",
      "value": "a7e18d96efd3cdb127ef4cdcad9e3ad26c482bf2",
      "href": "/ti/ioc/sha1/a7e18d96efd3cdb127ef4cdcad9e3ad26c482bf2",
      "context": "Malicious utils.js in @asyncapi/generator-helpers (Wiz IOC table)."
    },
    {
      "kind": "sha1",
      "value": "9890950adcbc2478e7a080234f053214adbad44e",
      "href": "/ti/ioc/sha1/9890950adcbc2478e7a080234f053214adbad44e",
      "context": "Malicious ErrorHandling.js in @asyncapi/generator-components (Wiz IOC table)."
    },
    {
      "kind": "sha256",
      "value": "62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0",
      "href": "/ti/ioc/sha256/62ee164b9b306250c1172583f138c9614139264f889fa99614903c12755468d0",
      "context": "SHA-256 hash from blog post"
    },
    {
      "kind": "sha256",
      "value": "a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a",
      "href": "/ti/ioc/sha256/a3894003ad1d293ba96d77881ccd2071446dc3f65f434669b49b3da92421901a",
      "context": "SHA-256 hash from blog post"
    },
    {
      "kind": "sha1",
      "value": "c70e105e212ff3c1daa04bb2a62507717f296b0b",
      "href": "/ti/ioc/sha1/c70e105e212ff3c1daa04bb2a62507717f296b0b",
      "context": "Malicious index.js in @asyncapi/specs (Wiz IOC table)."
    }
  ],
  "ttps": [
    {
      "name": "CI/CD pull_request_target Pwn Request",
      "href": "/ti/ttps/ci-cd-pull-request-target-pwn-request"
    },
    {
      "name": "Decoy Pull Request Flood",
      "href": "/ti/ttps/decoy-pull-request-flood"
    },
    {
      "name": "Valid Accounts",
      "mitre_attack_id": "T1078",
      "href": "/ti/ttps/T1078"
    },
    {
      "name": "Compromise Software Supply Chain",
      "mitre_attack_id": "T1195.002",
      "href": "/ti/ttps/T1195.002"
    },
    {
      "name": "Whitespace Padding Concealment",
      "href": "/ti/ttps/whitespace-padding-concealment"
    },
    {
      "name": "Obfuscated Files or Information",
      "mitre_attack_id": "T1027",
      "href": "/ti/ttps/T1027"
    },
    {
      "name": "Ingress Tool Transfer",
      "mitre_attack_id": "T1105",
      "href": "/ti/ttps/T1105"
    },
    {
      "name": "Systemd Service",
      "mitre_attack_id": "T1543.002",
      "href": "/ti/ttps/T1543.002"
    },
    {
      "name": "Credentials from Password Stores",
      "mitre_attack_id": "T1555",
      "href": "/ti/ttps/T1555"
    },
    {
      "name": "Unsecured Credentials: Credentials In Files",
      "mitre_attack_id": "T1552.001",
      "href": "/ti/ttps/T1552.001"
    },
    {
      "name": "Resilient Multi-Channel C2",
      "href": "/ti/ttps/resilient-multi-channel-c2"
    },
    {
      "name": "Exfiltration Over C2 Channel",
      "mitre_attack_id": "T1041",
      "href": "/ti/ttps/T1041"
    },
    {
      "name": "Exfiltration Over Web Service",
      "mitre_attack_id": "T1567",
      "href": "/ti/ttps/T1567"
    },
    {
      "name": "Compromise Software Dependencies and Development Tools",
      "mitre_attack_id": "T1195.001",
      "href": "/ti/ttps/T1195.001"
    },
    {
      "name": "Command and Scripting Interpreter: JavaScript",
      "mitre_attack_id": "T1059.007",
      "href": "/ti/ttps/T1059.007"
    },
    {
      "name": "Steal Application Access Token",
      "mitre_attack_id": "T1528",
      "href": "/ti/ttps/T1528"
    },
    {
      "name": "Application Layer Protocol: Web Protocols",
      "mitre_attack_id": "T1071.001",
      "href": "/ti/ttps/T1071.001"
    },
    {
      "name": "Web Service",
      "mitre_attack_id": "T1102",
      "href": "/ti/ttps/T1102"
    },
    {
      "name": "Event Triggered Execution",
      "mitre_attack_id": "T1546",
      "href": "/ti/ttps/T1546"
    },
    {
      "name": "Remote Services",
      "mitre_attack_id": "T1021",
      "href": "/ti/ttps/T1021"
    },
    {
      "name": "Account Manipulation",
      "mitre_attack_id": "T1098",
      "href": "/ti/ttps/T1098"
    }
  ],
  "related_campaigns": [
    {
      "name": "Miasma: The Spreading Blight",
      "slug": "miasma-the-spreading-blight",
      "href": "/ti/campaigns/miasma-the-spreading-blight",
      "relationship": "variant-of"
    }
  ],
  "reports": [
    {
      "title": "M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions",
      "url": "https://www.wiz.io/blog/m-red-team-asyncapi-supply-chain-compromise-via-github-actions",
      "published_at": "2026-07-14"
    },
    {
      "title": "AsyncAPI Packages Compromised with Miasma-Branded Credential Stealer (miasma-train-p1)",
      "url": "https://safedep.io/asyncapi-generator-supply-chain-attack-miasma-rat",
      "published_at": "2026-07-14"
    },
    {
      "title": "Shai-Hulud 2.0 npm Supply Chain Attack Technical Analysis",
      "url": "https://safedep.io/shai-hulud-second-coming-supply-chain-attack",
      "published_at": "2025-11-24"
    }
  ]
}