Hackers Abuse GitHub Actions to Backdoor AsyncAPI npm Packages With Miasma RAT

A supply chain attack has pushed Miasma malware into trusted AsyncAPI npm packages, putting developer systems and automated build environments at risk.

Attackers used a compromised release process to publish malicious code through the project’s legitimate npm namespace.

The affected packages had a combined reach of about 2.9 million weekly downloads, although download figures do not confirm infections.

The campaign is concerning because these tools can run inside development workstations, documentation jobs, and CI/CD pipelines that often hold sensitive credentials.

Cato Networks said in a report shared with Cyber Security News (CSN) that it identified the activity through supply chain intelligence monitoring.

Its researchers found that the attackers used a trusted software release path to distribute a Miasma-associated Node.js payload.

The incident shows why valid package names and official publishing workflows are no longer enough to establish trust.

As seen in a recent compromised GitHub Action incident, attackers can target automation itself to gain access to secrets and downstream projects.

Hackers Abuse GitHub Actions

The attack began with a vulnerable GitHub Actions configuration that allowed untrusted pull request content to interact with a privileged workflow context.

This gave the attacker a path to obtain or abuse an AsyncAPI automation identity and make unauthorized repository changes.

The malicious changes were placed in a branch tied to the project’s release process and designed to resemble ordinary development activity.

AsyncAPI’s own publishing automation then released the altered packages, making them appear legitimate because they came from the expected npm namespace.

This technique makes the incident different from a simple typosquatting operation, where criminals publish lookalike packages under unfamiliar accounts.

It also echoes the risks described in the GitHub Actions workflow attack, where unsafe handling of untrusted pull request activity can expose tokens and cloud credentials.

The malicious releases were @asyncapi/generator version 3.3.1, @asyncapi/generator-helpers version 1.1.1, @asyncapi/generator-components version 0.7.1, and @asyncapi/specs versions 6.11.2-alpha.1 and 6.11.2.

Teams that automatically restored dependencies during the exposure window may have pulled the affected code into build environments.

Miasma Uses Stealthy Execution

The injected JavaScript did not depend on common npm lifecycle scripts such as postinstall.

Instead, it ran when an affected module was imported, allowing the malware to remain inactive after installation and execute later during a build, application run, documentation task, or CI/CD job.

The first-stage code launched a detached Node.js process and downloaded an encrypted second-stage payload from IPFS.

Researchers said the payload could maintain access, run remote commands, handle files, update itself, and communicate with attacker-controlled infrastructure.

This approach follows a broader pattern of npm attacks that avoid obvious installation hooks. Earlier campaigns involving malicious binding.gyp package files similarly attempted to bypass checks focused only on standard package scripts.

Miasma also used an Ethereum contract as a fallback source for command-and-control configuration, including alternative endpoints, relay information, and bootstrap data.

The configuration reviewed in this case behaved mainly as a remote-access tool, so researchers described it as a Miasma-associated RAT rather than assuming it would spread automatically in every affected environment.

Organizations should check manifests, lockfiles, caches, and build artifacts for the affected versions, then determine whether they were imported or executed.

Security teams should also search for the named payload, review outbound connections and repository logs, rotate accessible credentials, and tighten privileged workflows that use pull_request_target.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

! ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure