← News
/DISPATCH · 2026-07-25

AsyncAPI npm packages hit by supply-chain attack: import-time execution bypasses --ignore-scripts

Microsoft Threat Intelligence found malicious loaders in five AsyncAPI npm package versions. The loaders run at import time, bypassing npm install --ignore-scripts, and deliver the Miasma RAT via IPFS.

Incident overview

On 14 July 2026, Microsoft Threat Intelligence disclosed an npm supply-chain attack against the AsyncAPI open-source org. Attackers stole a publish token via a vulnerable GitHub Actions workflow and injected a malicious loader into five npm package versions. The loader runs at import time, not via a postinstall lifecycle hook, so `npm install --ignore-scripts` does not stop it.

Attack timeline

| Time (UTC) | Event | | --- | --- | | ~07:10 | @asyncapi/generator@3.3.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator-helpers@1.1.1 republished | | 08:06:20 | @asyncapi/specs@6.11.2-alpha.1 published; malicious loader prepended to index.js | | 08:30:09 | @asyncapi/specs@6.11.2 stable published with the same payload | | 08:49:22 | First observed pull of the stable tarball into a Yarn cache |

Compromised packages

Five versions, four package names:

@asyncapi/specs is a transitive dependency of many AsyncAPI toolkits, so the blast radius exceeds direct dependents.

Technical details

GitHub Actions exploit

Target: asyncapi/generator. Vulnerable workflow manual-netlify-preview.yml used the `pull_request_target` trigger, so the job ran in the target repo security context while checking out untrusted PR code. Attackers stole the asyncapi-bot PAT and gained push-as-bot.

Not a new bug: PoC public 29 April 2026; community fix proposed 17 May; attack landed while the patch was still in review.

Import-time execution

Unlike classic npm supply-chain attacks that use postinstall hooks, this campaign fires at import time:

spawn('node', [payloadPath], {
    detached: true,
    stdio: 'ignore',
    windowsHide: true
}).unref();

When a developer `require()`s or `import`s the infected module, that snippet immediately spawns a hidden, detached Node.js child that fetches stage 2 from IPFS. Trigger is module load, so `--ignore-scripts` and install-time scanners miss it.

Multi-stage payload

C2 infrastructure

Primary C2 at `85.137.53[.]71`, ports 8080 (C2 control), 8081 (data upload), 8091 (admin config). Fallback channels: Nostr, Ethereum, BitTorrent DHT, IPFS.

Impact

AsyncAPI is an open spec for event-driven and message-driven APIs, used in microservices, IoT, and financial trading. Transitive deps can land in CI/CD pipelines, container builds, and live services. Payload already includes (currently disabled) modules for credential theft, supply-chain worming, and AI-tool poisoning — high expansion potential.

Remediation

Immediate actions

Threat hunting

Long-term hardening

Sources