Compromised AsyncAPI npm Packages Delivered Miasma Malware via IPFS Loader

Multiple @asyncapi npm packages were compromised in a software supply-chain attack that inserted a multi-stage malware loader into widely used developer tooling with roughly 2 million weekly downloads. Reports identified malicious versions including @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator@3.3.1, and additional trojanized packages in the namespace, with one analysis counting five affected packages. The injected code was hidden in src/utils.js and triggered during normal require() or import execution rather than npm lifecycle hooks, spawning a detached Node.js child process that fetched an encrypted second-stage payload from IPFS and wrote it to disk as sync.js in user-specific directories across macOS, Linux, and Windows.

Researchers said the second stage was a Miasma variant or related botnet framework that established persistence, beaconed to 85.137.53.71:8080, and enabled remote shell access for arbitrary command execution. Analyses also described broader built-in capabilities for file operations, credential harvesting, evasion, propagation, mutation, and destructive actions, though some of those functions were reportedly disabled in the observed build. Security firms warned that developer workstations and CI environments using the affected packages may have been exposed, advised avoiding the malicious versions, upgrading once clean releases are available, inspecting systems for compromise, and rotating potentially exposed credentials; one report added that @asyncapi/specs@6.11.2-alpha.1 remained directly downloadable even after removal from registry metadata.