Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity. The affected packages are @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator@3.3.1, and @asyncapi/specs (v6.11.2, v6.11.2-alpha.1).

The compromised packages deploy an obfuscated first-stage payload that downloads an encrypted second-stage payload, identified as Miasma, from IPFS. The poisoned packages ship a hidden JavaScript implant, with each containing an injected source file that decodes to the same second-stage downloader. Unlike previous iterations that leveraged install hooks, the malicious code runs when the infected module is loaded by Node.js, launching a detached background node that downloads and executes the malware from IPFS.

The next-stage payload is an encrypted JavaScript loader named “sync.js,” written to operating system-specific paths and executed. The loader contains two components: the encrypted final JavaScript payload decoding to the Miasma tasking framework, and a large encrypted blob used by the runtime’s spawn-chain framework. The framework bundles 744 modules and supports six independent command-and-control (C2) communication channels using HTTP, Nostr relay, IPFS, BitTorrent DHT, libp2p GossipSub P2P mesh, and an Ethereum smart contract.

Miasma facilitates credential theft, AI tool poisoning, LAN lateral movement, and worm-like propagation on npm, PyPI, and Cargo registries. It features a persistence mechanism setting up systemd, crontab, macOS launchd, and Windows Registry autostart keys. The malware incorporates a dead man’s switch that monitors a stolen token and triggers a directory wipe if the token is revoked, while avoiding systems identified as sandboxes or virtual environments, as well as those with Russian language settings or security tools from CrowdStrike, SentinelOne, Microsoft Defender, CarbonBlack, Cylance, Osquery, Tanium, and Qualys.

According to StepSecurity, the attacker gained push access to the repositories and used the project’s own legitimate GitHub Actions release pipeline to publish packages with valid OIDC provenance attestations. The supply chain attack did not involve theft of an npm token. All five malicious versions have since been unpublished from the npm registry.