Loading malware…
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Three malicious versions of AsyncAPI packages were published to npm on 2026-07-14 at 07:10 UTC via a compromised CI workflow. A threat actor gained write access to the next branch and pushed a commit injecting a credential-stealing RAT dropper into the source of all three packages.
A threat actor gained write access to the next branch and pushed a commit injecting a credential-stealing RAT dropper into the source of all three packages. The release workflow on the next branch triggered automatically, and asyncapi-bot published all three packages via GitHub Actions OIDC within seconds.
spawn ( "node" , [ "-e" , "<stage2_script>" ] , { detached : true , stdio : "ignore" , windowsHide : true } ) . unref ( )
Stage 1 - fires at require() time (no install hook needed) The injected IIFE runs immediately when the poisoned file is require() d during normal generator operation.
The commit modified three source files in the monorepo, injecting a ~7.7KB obfuscated JavaScript payload as a whitespace-padded single line (hidden ~1000 spaces off-screen) in each.
Creates a hidden directory based on OS: Linux: ~/.local/share/NodeJS/ macOS: ~/Library/Application Support/NodeJS/ Windows: %LOCALAPPDATA%\NodeJS\
Dead-man switch ( safe-wipe.js ) that monitors a stolen token and triggers a directory wipe if the token is revoked.
Stage 3 - Miasma RAT ( sync.js , fully decrypted) sync.js is a self-decrypting AES-256-GCM payload (HKDF-SHA256, hardcoded master key rt-vault-master-key-32b-aaaaaaaa ). Once decrypted it is a full credential-stealing RAT
the main() function calls spawn('node', ['-e', PAYLOAD_STRING], { detached: true, stdio: 'ignore', windowsHide: true }).unref().
Sandbox evasion ( sandbox-guard.js ) with detection for CrowdStrike, SentinelOne, Microsoft Defender, CarbonBlack, Cylance, Osquery, Tanium, and Qualys.
Stage 1 - fires at require() time (no install hook needed) The injected IIFE runs immediately when the poisoned file is require() d during normal generator operation.
Credential targets: Browser profiles: Login Data , Cookies , Local State (Chrome, Brave, Firefox, Edge)
A representative sample of targeted paths from the decrypted source: ~/.aws/* ... ~/.npmrc ... ~/.config/gh/hosts.yml ... ~/.docker/config.json
SSH keys: ~/.ssh/id_rsa , ~/.ssh/id_ed25519 , ~/.ssh/config npm token: ~/.npmrc GitHub CLI: ~/.config/gh/ AWS: ~/.aws/credentials Git config: ~/.gitconfig
Credential targets: Browser profiles: Login Data , Cookies , Local State (Chrome, Brave, Firefox, Edge) ... macOS Keychain
Impact: Credential theft: browser passwords, SSH keys, npm tokens, GitHub CLI tokens, AWS credentials, cryptocurrency wallets
Sandbox evasion ( sandbox-guard.js ) with detection for CrowdStrike, SentinelOne, Microsoft Defender, CarbonBlack, Cylance, Osquery, Tanium, and Qualys.
Credential targets: Browser profiles ... SSH keys ... npm token ... AWS credentials ... Git config ... Crypto wallets: MetaMask, Ledger
The decrypted source contains a ChannelOrchestratorImpl class that manages seven independent communication channels with tiered failover.
Downloads sync.js (8.25MB) from IPFS CID QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9 Executes it silently
Beacons go to /api/v1/beacon, stolen data to /api/v1/upload, and command polling to /api/v1/commands/{nodeId}.
C2 infrastructure: HTTP exfil: http://85.137.53.71:8081
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.