Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware
A sophisticated supply-chain attack leveraging compromised npm packages has delivered a multi-stage botnet loader, Miasma, to numerous developers. The attacker exploited a GitHub Actions release pipeline to inject malicious code into seemingly legitimate packages, bypassing traditional npm security measures. The malware utilizes a complex C2 infrastructure and incorporates a dead man's switch to evade detection and persist on compromised systems.
A supply-chain attack involving compromised npm packages has resulted in the deployment of a multi-stage botnet loader, Miasma. According to OX Security, SafeDep, Socket, and StepSecurity, four packages – @asyncapi/[email protected], @asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/specs(v6.11.2, v6.11.2-alpha.1) – were poisoned with malicious code. The attacker gained push access to the repositories and utilized GitHub Actions to publish packages with valid OIDC provenance attestations, creating a deceptive layer of trust.
Unlike previous attacks relying on stolen npm tokens, this incident did not involve the theft of credentials. Instead, the malicious code was injected through a compromised GitHub Actions release pipeline, allowing the attacker to bypass standard npm security checks. The malware employs a multi-stage approach, beginning with an obfuscated first-stage payload that downloads an encrypted second-stage payload – Miasma – from IPFS.
This Miasma framework utilizes a complex command-and-control (C2) infrastructure, leveraging six independent channels: HTTP, Nostr relay, IPFS, BitTorrent DHT, libp2p GossipSub P2P mesh, and an Ethereum smart contract. It’s designed for credential theft, AI tool poisoning, LAN lateral movement, and worm-like propagation across npm, PyPI, and Cargo registries. The framework also includes a persistence mechanism, setting up systemd, crontab, macOS launchd, and Windows Registry autostart keys.
Notably, the malware incorporates a dead man's switch that monitors a stolen token and triggers a directory wipe if the token is revoked, while actively avoiding sandboxes and virtual environments, as well as systems with Russian language settings or security tools from CrowdStrike, SentinelOne, Microsoft Defender, CarbonBlack, Cylance, Osquery, Tanium, and Qualys installed. The attacker used a placeholder git identity and exploited the repository’s existing release workflow to publish packages with legitimate SLSA provenance attestations, falsely indicating that the packages were produced by an authorized workflow, not by a compromised push credential.
All five malicious versions have since been unpublished from the npm registry. Developers are advised to treat any endpoint that imported or executed one of the affected package versions as potentially compromised, with exposure depending on whether the infected module was loaded as part of a build or a developer workflow. The absence of preinstall/postinstall/install scripts within the package.json files highlights that the dropper is triggered during normal use of the generator – the moment a build or CI job calls into the library, not at npm install time.