malware npm

@asyncapi/generator-components

discovered 2026-07-14

Compromised alongside @asyncapi/generator. Obfuscated payload embedded in lib/utils/ErrorHandling.js. Published 2026-07-14T07:10:44Z. ~46,000 weekly downloads.

Threat types

credential_stealer rat c2_agent data_exfiltration persistence

Malicious versions

0.7.1

Campaigns

miasma-train-p1attributed-to

Indicators

sha1 9890950adcbc2478e7a080234f053214adbad44eindicates