Compromised @asyncapi npm packages distributing the Miasma loader
Malware Activity
Summary
Hide ▲
Show ▼
Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load. The hidden implant fetches an encrypted second stage from IPFS and runs it outside the install path. The payload is built for credential theft, persistence, and broader post-compromise control. Any build or developer workflow that loaded one of the affected packages may have executed the malware.
Related Happenings
North Korean npm developer-targeting blockchain-C2 campaign
Campaign
H score41
First: 29.07.2026 07:20
Last: 29.07.2026 07:20
Sources 1
About this happening:
An ongoing North Korean npm supply-chain campaign is delivering DEV#POPPER-linked payloads through compromised @joyfill packages, exposing developers to remote acces...
North Korean npm developer-targeting blockchain-C2 campaign
CampaignAbout this happening: An ongoing North Korean npm supply-chain campaign is delivering DEV#POPPER-linked payloads through compromised @joyfill packages, exposing developers to remote acces...
ViteVenom malicious npm packages delivering blockchain-backed RAT
Malware Activity
H score3
First: 17.07.2026 21:54
Last: 17.07.2026 21:54
Sources 1
About this happening:
A cluster of seven malicious npm packages has targeted the Vite frontend ecosystem, delivering a blockchain-backed RAT loader that can harvest credentials and exfiltra...
ViteVenom malicious npm packages delivering blockchain-backed RAT
Malware ActivityAbout this happening: A cluster of seven malicious npm packages has targeted the Vite frontend ecosystem, delivering a blockchain-backed RAT loader that can harvest credentials and exfiltra...
SuccessKey ViteVenom ChainVeil supply-chain campaign targeting Vite developers
Campaign
H score8
First: 17.07.2026 21:54
Last: 17.07.2026 21:54
Sources 1
About this happening:
The SuccessKey-linked ViteVenom campaign is targeting Vite developers with seven malicious npm packages and a blockchain-based C2 path that delivers a RAT....
SuccessKey ViteVenom ChainVeil supply-chain campaign targeting Vite developers
CampaignAbout this happening: The SuccessKey-linked ViteVenom campaign is targeting Vite developers with seven malicious npm packages and a blockchain-based C2 path that delivers a RAT....
AsyncAPI malicious npm package supply-chain malware
Malware Activity
H score21
First: 15.07.2026 18:37
Last: 15.07.2026 18:37
Sources 1
About this happening:
Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...
AsyncAPI malicious npm package supply-chain malware
Malware ActivityAbout this happening: Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...
AsyncAPI repositories and npm publishing workflow hit by network compromise
Incident
H score27
First: 15.07.2026 12:16
Last: 15.07.2026 12:16
Sources 1
How related:
According to StepSecurity, the attacker is said to have gained push access to the repositories and used the project's own legitimate GitHub Actions release pipeline to publish packages with valid OIDC provenance attestations.
About this happening:
The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
AsyncAPI repositories and npm publishing workflow hit by network compromise
IncidentHow related: According to StepSecurity, the attacker is said to have gained push access to the repositories and used the project's own legitimate GitHub Actions release pipeline to publish packages with valid OIDC provenance attestations.
About this happening: The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
Timeline
-
15.07.2026 12:16 1 articles · 13d ago
Compromised @asyncapi npm packages deliver a Miasma botnet loader
Initial DisclosureFour compromised npm packages in the @asyncapi namespace were observed distributing a multi-stage botnet loader that fetches an encrypted second stage, Miasma, from IPFS and runs it as a hidden Node.js implant. The poisoned packages include @asyncapi/[email protected], @asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/specs v6.11.2 and v6.11.2-alpha.1. The malicious code runs when the infected module is loaded by Node.js, writes an encrypted loader named sync.js to OS-specific paths, and executes it outside the install path. StepSecurity said the attacker gained push access to the repositories and used the project's legitimate GitHub Actions release pipeline with valid OIDC provenance attestations, while the malicious versions were later unpublished from the npm registry.
Show sources
- Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware — thehackernews.com — 15.07.2026 12:16