AsyncAPI npm Packages Backdoored With Miasma RAT - CyDhaal - Your Daily Dose of Cyber Intelligence

Multiple AsyncAPI npm packages were compromised when attackers exploited GitHub Actions workflows to inject Miasma RAT malware. The supply chain attack affected several widely-used packages, exposing thousands of downstream users to remote access trojans. The threat actors leveraged compromised GitHub tokens with write permissions to push malicious code through automated CI/CD pipelines, bypassing traditional code review processes.

Introduction

The open-source ecosystem faces yet another critical supply chain attack as the AsyncAPI project confirmed that several of its npm packages were backdoored with Miasma RAT malware. This sophisticated attack leveraged GitHub Actions workflows to inject malicious code into legitimate packages, demonstrating an evolution in adversary techniques targeting automated deployment pipelines.

AsyncAPI, a popular specification for building event-driven architectures, maintains numerous npm packages used by thousands of organizations worldwide. The compromise represents a significant escalation in supply chain attacks, moving beyond credential theft to exploiting the very automation systems designed to improve software security and delivery speed.

This incident highlights critical vulnerabilities in modern CI/CD pipelines and raises urgent questions about trust boundaries within automated deployment workflows.

Background & Context

AsyncAPI provides tools and specifications for defining asynchronous APIs, similar to OpenAPI but focused on event-driven architectures. The project maintains multiple npm packages that are dependencies for countless enterprise applications and microservices architectures.

Supply chain attacks targeting npm packages have increased dramatically over the past three years. Previous incidents like the ua-parser-js compromise, event-stream backdoor, and colors/faker sabotage demonstrated various attack vectors. However, this AsyncAPI incident represents a more sophisticated approach by exploiting GitHub Actions rather than simply compromising maintainer credentials.

GitHub Actions provides automated workflow capabilities integrated directly into repositories. These workflows often have elevated permissions to publish packages, merge code, and modify repository settings. When properly configured, they enhance security by limiting human access to sensitive operations. However, misconfigured workflows or compromised tokens can provide attackers with powerful deployment capabilities.

Miasma RAT is a remote access trojan that provides attackers with comprehensive control over infected systems. Once installed, it enables command execution, data exfiltration, credential harvesting, and lateral movement capabilities.

Technical Breakdown

The attack chain involved multiple sophisticated steps exploiting GitHub’s automation infrastructure:

Initial Access

Attackers gained access to GitHub Actions secrets containing npm authentication tokens with publish permissions. The exact initial access vector remains under investigation, but possibilities include:

Compromised maintainer accounts with access to repository secrets
Leaked GitHub Personal Access Tokens (PATs) from previous breaches
Exploitation of overly permissive GitHub Actions workflow configurations

Workflow Manipulation

Once authenticated, attackers modified existing GitHub Actions workflows or created new ones designed to trigger on specific events. The malicious workflow files likely resembled:

name: Malicious Publish Workflow
on:
  workflow_dispatch:
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Setup Node
        uses: actions/setup-node@v3
      - name: Inject Payload
        run: |
          echo "const malicious = require('./miasma-loader');" >> index.js
          npm version patch
      - name: Publish to npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish

Malware Injection

The Miasma RAT payload was injected into package files using obfuscated JavaScript. The malware employed several anti-detection techniques:

// Obfuscated loader example
const _0x4a3b=['exec','child_process','https://c2.example[.]com'];
(function(_0x2d8f05,_0x4b81bb){
  // Decoding and execution logic
})();

The payload established persistence through post-install scripts in package.json:

{
  "scripts": {
    "postinstall": "node ./scripts/setup.js"
  }
}

Command and Control

Miasma RAT established encrypted connections to attacker-controlled infrastructure, enabling:

Remote command execution
File system access
Environment variable harvesting (targeting credentials and API keys)
Network reconnaissance
Additional payload delivery

Impact & Risk Assessment

Immediate Impact

Affected Packages: Multiple AsyncAPI packages received malicious versions
Download Statistics: Thousands of installations occurred before discovery
Exposure Window: Estimated 48-72 hours between injection and detection
Compromised Systems: Developers’ machines and CI/CD environments

Downstream Risk

Organizations using affected package versions face:

Data Exfiltration: Source code, credentials, and proprietary information theft
Lateral Movement: Compromised developer workstations serving as pivot points
Supply Chain Propagation: Further contamination of internal packages and applications
Compliance Violations: Potential breach notification requirements under GDPR, CCPA, and other regulations

Critical Severity Factors

This attack earns critical severity classification due to:

Exploitation of trusted automation infrastructure
Compromise of widely-used development tooling
Extended exposure window before detection
Sophisticated malware with remote access capabilities
Difficulty in complete remediation

Vendor Response

AsyncAPI project maintainers responded swiftly upon discovery:

Immediate Actions: Unpublished compromised package versions from npm registry within hours of confirmation
Token Revocation: Rotated all npm publish tokens and GitHub Actions secrets
Investigation Launch: Engaged security researchers to conduct forensic analysis
Communication: Published security advisories through GitHub Security Lab and npm advisory database
Workflow Hardening: Implemented stricter controls on GitHub Actions permissions

The npm security team coordinated removal efforts and flagged malicious versions in their advisory database. GitHub’s security team investigated potential platform-level vulnerabilities that may have facilitated the attack.

Mitigations & Workarounds

Immediate Actions

Organizations should immediately:

Identify Exposure: Audit package-lock.json and yarn.lock files for affected package versions:

npm ls @asyncapi/* --depth=0
grep -r "@asyncapi" package-lock.json

Update Packages: Upgrade to verified clean versions:

npm update @asyncapi/parser @asyncapi/generator
npm audit fix

Rotate Credentials: Assume compromise and rotate:

– API keys and tokens accessible from affected environments
– Database credentials
– Cloud provider access keys
– Internal service authentication tokens

Scan for IOCs: Search for Miasma RAT indicators:

# Check for suspicious outbound connections
netstat -an | grep ESTABLISHED
# Review npm postinstall scripts
npm explore @asyncapi/parser -- cat package.json | grep postinstall

Containment Measures

Isolate potentially compromised development machines from production networks
Review network logs for connections to known Miasma C2 infrastructure
Conduct memory analysis on suspected infected systems
Rebuild compromised environments from clean backups

Detection & Monitoring

Network-Level Detection

Monitor for suspicious patterns:

# Example Suricata rule
alert tcp any any -> any any (msg:"Potential Miasma RAT C2"; 
  content:"User-Agent|3a 20|Mozilla"; 
  pcre:"/POST.*\/api\/[a-f0-9]{32}/i"; 
  sid:1000001;)

Endpoint Detection

Implement monitoring for:

Unexpected child processes spawned by Node.js
Suspicious network connections from development tools
Modifications to package.json files outside normal workflow
Unauthorized access to credential stores and environment variables

CI/CD Pipeline Monitoring

# GitHub Actions security workflow
name: Security Monitoring
on: [push, workflow_dispatch]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Audit Dependencies
        run: |
          npm audit --audit-level=moderate
          npm ls --depth=0 | grep asyncapi

Log Analysis

Review logs for:

Unexpected npm publish operations
GitHub Actions workflow modifications
Secret access patterns
Anomalous download patterns from package registries

Best Practices

Securing GitHub Actions

Principle of Least Privilege: Limit workflow permissions:

permissions:
  contents: read
  packages: write

Environment Protection: Require manual approval for sensitive operations:

environment:
  name: production
  approval: required

Secret Scoping: Use environment-specific secrets rather than repository-wide access
Workflow Auditing: Monitor all workflow file changes with required reviews

Supply Chain Security

Dependency Pinning: Use exact versions in package.json:

{
  "dependencies": {
    "@asyncapi/parser": "1.2.3"
  }
}

Integrity Verification: Implement Subresource Integrity (SRI) checks
Private Registry Proxying: Mirror public packages through internal registries with security scanning
Software Bill of Materials: Maintain comprehensive SBOM documentation

Organizational Measures

Implement mandatory two-factor authentication for all developers
Conduct regular security training on supply chain attacks
Establish incident response procedures for dependency compromises
Deploy endpoint detection and response (EDR) on developer workstations
Network segmentation between development and production environments

Key Takeaways

CI/CD Pipelines Are Attack Vectors: Automated deployment infrastructure requires the same security scrutiny as production systems
Trust Boundaries Matter: Even trusted automation can be compromised; implement defense in depth
Speed of Response Critical: Rapid detection and remediation minimize exposure windows in supply chain attacks
Comprehensive Credential Rotation: Assume full compromise and rotate all accessible secrets
Monitoring Investments Required: Effective detection requires visibility into development environments, not just production
Supply Chain Due Diligence: Dependency selection should include security posture evaluation of maintainer practices
GitHub Actions Security: Workflow permissions and secret management require careful configuration and regular auditing

This incident reinforces that supply chain security cannot be an afterthought. Organizations must implement comprehensive controls across development tooling, automated workflows, and dependency management to defend against increasingly sophisticated attacks targeting the software delivery pipeline.

References

AsyncAPI Project Security Advisory (GitHub)
npm Security Advisory Database
GitHub Actions Security Best Practices Documentation
MITRE ATT&CK: Supply Chain Compromise (T1195)
CISA Software Supply Chain Security Guidance
OpenSSF Securing Software Repositories Best Practices
Sonatype 2024 State of Software Supply Chain Report

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/