AsyncAPI npm Packages Compromised with Malicious Payload
An early warning indicates that three AsyncAPI npm packages may have been compromised with a malicious payload. Users of @asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, and @asyncapi/generator-components@0.7.1 are advised to assess their exposure.
What happened
Reportedly, three packages in the AsyncAPI generator monorepo were compromised and published to npm with an obfuscated dropper. The packages were published through the project's legitimate GitHub Actions release workflow after the attacker gained push access to the repository's next branch.
The compromised packages appear to deploy an obfuscated first-stage payload that downloads an encrypted second-stage payload, identified as Miasma, from IPFS. The malicious code is run when the infected module is loaded by Node.js, after which it launches a detached background node that downloads and executes the malware from IPFS.
It is under investigation how the attacker gained push access to the repository and utilized the project's CI/CD pipeline to publish the malicious packages. Users are recommended to avoid using versions @3.3.1 of @asyncapi/generator, @1.1.1 of @asyncapi/generator-helpers, and @0.7.1 of @asyncapi/generator-components. Monitor for any suspicious activity in environments where these packages were used.
How 0Day mitigates this
@asyncapi/generator is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.