AsyncAPI npm Packages Backdoored With Miasma RAT

Multiple AsyncAPI npm packages were compromised when attackers exploited GitHub Actions workflows to inject Miasma RAT malware. The supply chain attack affected several widely-used packages, exposing thousands of downstream users to remote access trojans. The threat actors leveraged compromised GitHub tokens with write permissions to push malicious code through automated CI/CD pipelines, bypassing traditional code review processes.

Introduction

The open-source ecosystem faces yet another critical supply chain attack as the AsyncAPI project confirmed that several of its npm packages were backdoored with Miasma RAT malware. This sophisticated attack leveraged GitHub Actions workflows to inject malicious code into legitimate packages, demonstrating an evolution in adversary techniques targeting automated deployment pipelines.

AsyncAPI, a popular specification for building event-driven architectures, maintains numerous npm packages used by thousands of organizations worldwide. The compromise represents a significant escalation in supply chain attacks, moving beyond credential theft to exploiting the very automation systems designed to improve software security and delivery speed.

This incident highlights critical vulnerabilities in modern CI/CD pipelines and raises urgent questions about trust boundaries within automated deployment workflows.

Background & Context

AsyncAPI provides tools and specifications for defining asynchronous APIs, similar to OpenAPI but focused on event-driven architectures. The project maintains multiple npm packages that are dependencies for countless enterprise applications and microservices architectures.

Supply chain attacks targeting npm packages have increased dramatically over the past three years. Previous incidents like the ua-parser-js compromise, event-stream backdoor, and colors/faker sabotage demonstrated various attack vectors. However, this AsyncAPI incident represents a more sophisticated approach by exploiting GitHub Actions rather than simply compromising maintainer credentials.

GitHub Actions provides automated workflow capabilities integrated directly into repositories. These workflows often have elevated permissions to publish packages, merge code, and modify repository settings. When properly configured, they enhance security by limiting human access to sensitive operations. However, misconfigured workflows or compromised tokens can provide attackers with powerful deployment capabilities.

Miasma RAT is a remote access trojan that provides attackers with comprehensive control over infected systems. Once installed, it enables command execution, data exfiltration, credential harvesting, and lateral movement capabilities.

Technical Breakdown

The attack chain involved multiple sophisticated steps exploiting GitHub’s automation infrastructure:

Initial Access

Attackers gained access to GitHub Actions secrets containing npm authentication tokens with publish permissions. The exact initial access vector remains under investigation, but possibilities include:

• Compromised maintainer accounts with access to repository secrets
• Leaked GitHub Personal Access Tokens (PATs) from previous breaches
• Exploitation of overly permissive GitHub Actions workflow configurations

Workflow Manipulation

Once authenticated, attackers modified existing GitHub Actions workflows or created new ones designed to trigger on specific events. The malicious workflow files likely resembled:

name: Malicious Publish Workflow
on:
  workflow_dispatch:
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Setup Node
        uses: actions/setup-node@v3
      - name: Inject Payload
        run: |
          echo "const malicious = require('./miasma-loader');" >> index.js
          npm version patch
      - name: Publish to npm
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
        run: npm publish

Malware Injection

The Miasma RAT payload was injected into package files using obfuscated JavaScript. The malware employed several anti-detection techniques:

// Obfuscated loader example
const _0x4a3b=['exec','child_process','https://c2.example[.]com'];
(function(_0x2d8f05,_0x4b81bb){
  // Decoding and execution logic
})();

The payload established persistence through post-install scripts in package.json:

{
  "scripts": {
    "postinstall": "node ./scripts/setup.js"
  }
}

Command and Control

Miasma RAT established encrypted connections to attacker-controlled infrastructure, enabling:

• Remote command execution
• File system access
• Environment variable harvesting (targeting credentials and API keys)
• Network reconnaissance
• Additional payload delivery

Impact & Risk Assessment

Immediate Impact

• Affected Packages: Multiple AsyncAPI packages received malicious versions
• Download Statistics: Thousands of installations occurred before discovery
• Exposure Window: Estimated 48-72 hours between injection and detection
• Compromised Systems: Developers’ machines and CI/CD environments

Downstream Risk

Organizations using affected package versions face:

• Data Exfiltration: Source code, credentials, and proprietary information theft
• Lateral Movement: Compromised developer workstations serving as pivot points
• Supply Chain Propagation: Further contamination of internal packages and applications
• Compliance Violations: Potential breach notification requirements under GDPR, CCPA, and other regulations

Critical Severity Factors

This attack earns critical severity classification due to:

• Exploitation of trusted automation infrastructure
• Compromise of widely-used development tooling
• Extended exposure window before detection
• Sophisticated malware with remote access capabilities
• Difficulty in complete remediation

Vendor Response

AsyncAPI project maintainers responded swiftly upon discovery:

• Immediate Actions: Unpublished compromised package versions from npm registry within hours of confirmation
• Token Revocation: Rotated all npm publish tokens and GitHub Actions secrets
• Investigation Launch: Engaged security researchers to conduct forensic analysis
• Communication: Published security advisories through GitHub Security Lab and npm advisory database
• Workflow Hardening: Implemented stricter controls on GitHub Actions permissions

The npm security team coordinated removal efforts and flagged malicious versions in their advisory database. GitHub’s security team investigated potential platform-level vulnerabilities that may have facilitated the attack.

Mitigations & Workarounds

Immediate Actions

Organizations should immediately:

• Identify Exposure: Audit package-lock.json and yarn.lock files for affected package versions:

npm ls @asyncapi/* --depth=0
grep -r "@asyncapi" package-lock.json

• Update Packages: Upgrade to verified clean versions:

npm update @asyncapi/parser @asyncapi/generator
npm audit fix

• Rotate Credentials: Assume compromise and rotate:

– API keys and tokens accessible from affected environments
– Database credentials
– Cloud provider access keys
– Internal service authentication tokens

• Scan for IOCs: Search for Miasma RAT indicators:

# Check for suspicious outbound connections
netstat -an | grep ESTABLISHED
# Review npm postinstall scripts
npm explore @asyncapi/parser -- cat package.json | grep postinstall

Containment Measures

• Isolate potentially compromised development machines from production networks
• Review network logs for connections to known Miasma C2 infrastructure
• Conduct memory analysis on suspected infected systems
• Rebuild compromised environments from clean backups

Detection & Monitoring

Network-Level Detection

Monitor for suspicious patterns:

# Example Suricata rule
alert tcp any any -> any any (msg:"Potential Miasma RAT C2"; 
  content:"User-Agent|3a 20|Mozilla"; 
  pcre:"/POST.*\/api\/[a-f0-9]{32}/i"; 
  sid:1000001;)

Endpoint Detection

Implement monitoring for:

• Unexpected child processes spawned by Node.js
• Suspicious network connections from development tools
• Modifications to package.json files outside normal workflow
• Unauthorized access to credential stores and environment variables

CI/CD Pipeline Monitoring

# GitHub Actions security workflow
name: Security Monitoring
on: [push, workflow_dispatch]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Audit Dependencies
        run: |
          npm audit --audit-level=moderate
          npm ls --depth=0 | grep asyncapi

Log Analysis

Review logs for:

• Unexpected npm publish operations
• GitHub Actions workflow modifications
• Secret access patterns
• Anomalous download patterns from package registries

Best Practices

Securing GitHub Actions

• Principle of Least Privilege: Limit workflow permissions:

permissions:
  contents: read
  packages: write

• Environment Protection: Require manual approval for sensitive operations:

environment:
  name: production
  approval: required

• Secret Scoping: Use environment-specific secrets rather than repository-wide access
• Workflow Auditing: Monitor all workflow file changes with required reviews

Supply Chain Security

• Dependency Pinning: Use exact versions in package.json:

{
  "dependencies": {
    "@asyncapi/parser": "1.2.3"
  }
}

• Integrity Verification: Implement Subresource Integrity (SRI) checks
• Private Registry Proxying: Mirror public packages through internal registries with security scanning
• Software Bill of Materials: Maintain comprehensive SBOM documentation

Organizational Measures

• Implement mandatory two-factor authentication for all developers
• Conduct regular security training on supply chain attacks
• Establish incident response procedures for dependency compromises
• Deploy endpoint detection and response (EDR) on developer workstations
• Network segmentation between development and production environments

Key Takeaways

• CI/CD Pipelines Are Attack Vectors: Automated deployment infrastructure requires the same security scrutiny as production systems
• Trust Boundaries Matter: Even trusted automation can be compromised; implement defense in depth
• Speed of Response Critical: Rapid detection and remediation minimize exposure windows in supply chain attacks
• Comprehensive Credential Rotation: Assume full compromise and rotate all accessible secrets
• Monitoring Investments Required: Effective detection requires visibility into development environments, not just production
• Supply Chain Due Diligence: Dependency selection should include security posture evaluation of maintainer practices
• GitHub Actions Security: Workflow permissions and secret management require careful configuration and regular auditing

This incident reinforces that supply chain security cannot be an afterthought. Organizations must implement comprehensive controls across development tooling, automated workflows, and dependency management to defend against increasingly sophisticated attacks targeting the software delivery pipeline.

References

• AsyncAPI Project Security Advisory (GitHub)
• npm Security Advisory Database
• GitHub Actions Security Best Practices Documentation
• MITRE ATT&CK: Supply Chain Compromise (T1195)
• CISA Software Supply Chain Security Guidance
• OpenSSF Securing Software Repositories Best Practices
• Sonatype 2024 State of Software Supply Chain Report

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/