Poisoned Pipeline / Incidents / AS50
Miasma botnet loader in @asyncapi npm packages
On 14 July 2026 Socket found four compromised @asyncapi packages
(generator-helpers 1.1.1, generator-components 0.7.1, generator 3.3.1,
specs 6.11.2) shipping a hidden JS implant. Not an install-hook attack:
loading the module in Node starts a detached node -e process that
downloads an encrypted Miasma second stage from IPFS. Same implant
decoded from each injected file. Preceding versions were clean.
Mapped techniques
- T0121 Compromised legitimate artifact
- T0109 Publish malicious artifact
- T0159 Malicious artifact execution
- T0181 Malicious module injection
supply-chain @asyncapi namespace
Real @asyncapi packages, malicious versions published in seconds of each other.
Two batches on 14 July 2026.
Runs on module load, not on npm install.
One injected source file per package, same downloader.
Sources
- https://socket.dev/blog/asyncapi-supply-chain-attack
- https://opensourcemalware.com/blog/miasma-blight-reaches-microsoft-73-repos-disabled-in-105-seconds
- https://safedep.io/asyncapi-generator-supply-chain-attack-miasma-rat
- https://safedep.io/miasma-worm-hits-leoplatform-20-npm-packages
- https://safedep.io/miasma-worm-still-infected-github-repos
- https://safedep.io/inside-the-miasma-supply-chain-attack-toolkit
- https://safedep.io/config-files-that-run-code
- https://safedep.io/miasma-worm-ai-coding-agent-config-injection
- https://www.reversinglabs.com/blog/red-hat-cloud-service-npm-packages-backdoored-in-72-seconds
- https://www.reversinglabs.com/blog/why-software-delivery-cannot-depend-on-trust-alone
- https://www.aikido.dev/blog/asyncapi-npm-packages-backdoored-via-github-actions
- https://www.stepsecurity.io/blog/compromised-next-branch-pushes-malicious-asyncapi-generator-generator-helpers-and-generator-components-to-npm
- https://www.aikido.dev/blog/compromised-github-action-codfish-steals-secrets
- https://socket.dev/blog/miasma-mini-shai-hulud-hits-immobiliarelabs-npm-packages
- https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem