# Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories

Attacker with push access to two AsyncAPI repos injected an obfuscated dropper into source, letting legitimate GitHub Actions OIDC pipelines publish five malicious npm packages delivering Miasma RAT.

- Payout: Real-world hack
- Severity: critical
- Program: AsyncAPI
- Analysis by: StepSecurity
- Disclosed: 2026-07-16
- Write-up quality: 8/10
- Original: https://www.stepsecurity.io/blog/compromised-next-branch-pushes-malicious-asyncapi-generator-generator-helpers-and-generator-components-to-npm
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-compromised-next-branch-pushes-malicious-asyncapi-generator-generator-helpers-and-generator-compone
- Tags: area:oss domain:oss impact:data-leak impact:rce kind:incident platform:threat-intel sev:critical tech:ci-cd tech:github-actions tech:nodejs technique:recon technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** npm packages published via GitHub Actions release workflows (asyncapi/generator, asyncapi/spec-json-schemas)
**Root cause:** Attacker obtained push access to protected branches (next/master) under a placeholder git identity; the repos' own release workflows then published packages via npm OIDC trusted publishing, so provenance attestations were valid despite malicious commits.
**Steps:**
1. Push commit `3eab3ec9304aa26081358330491d3cfeb55cc245` to `next` branch of asyncapi/generator with ~7.7KB obfuscator.io payload padded with ~1000 leading spaces into `apps/generator/lib/templates/config/validator.js`, `packages/helpers/src/utils.js`, `packages/components/src/utils/ErrorHandling.js`
2. `release-with-changesets.yml` fires on refs/heads/next and publishes `@asyncapi/generator@3.3.1`, `@asyncapi/generator-helpers@1.1.1`, `@asyncapi/generator-components@0.7.1` via OIDC
3. On asyncapi/spec-json-schemas push `fix: correct JSON schema` commits to master injecting dropper into `index.js`; `if-nodejs-release.yml` publishes `@asyncapi/specs@6.11.2-alpha.1` and `6.11.2`
4. Dropper fires on `require()`: `spawn("node",["-e",<stage2>],{detached:true,stdio:"ignore",windowsHide:true}).unref()`
5. Stage 2 fetches `https://ipfs.io/ipfs/QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9` to `~/.local/share/NodeJS/sync.js` (Linux), `~/Library/Application Support/NodeJS/sync.js` (macOS), `%LOCALAPPDATA%\NodeJS\sync.js` (Windows), then `process.exit(0)`
6. Stage 3 sync.js decrypts AES-256-GCM baked config via HKDF-SHA256 (`rt-vault-master-key-32b-aaaaaaaa`, info `rt-baked-key`) revealing C2 `http://85.137.53.71:8080/8081/8091`, Nostr relays, Ethereum contract `0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710`, DHT bootstrap nodes
**How found:** StepSecurity detected compromised packages within 30 minutes of publication, downloaded tarballs, statically decoded obfuscator.io string-array rotation cipher in Python without executing, then ran payload in isolated Harden-Runner-monitored GitHub Actions job to capture C2 egress (85.137.53.71, BitTorrent DHT bootstrap).
**Exploitation:** Compromised push credential to protected branches; legitimate CI/CD OIDC publishes signed packages; dropper executes on library load in victim builds/CI, drops hidden sync.js, decrypts 3.08MB Miasma v3 RAT with six C2 channels (HTTP, Nostr, IPFS, DHT, libp2p, Ethereum), harvests browser creds/cookies, SSH keys, .npmrc, .gitconfig, gh config, AWS creds, kube config, Docker creds, macOS Keychain, GITHUB_TOKEN/NPM_TOKEN/PYPI_TOKEN; persists via systemd/cron/launchd/Registry; LAN lateral movement; metamorphic re-obfuscation; worm propagation modules (npm propagation disabled for this wave).
**Escalation:** Multi-channel C2 failover, EC public key chain for bot authentication, metamorphic mutation per generation, LAN spread and worm propagation modules, AI tool poisoning to compromise developer assistants.
**Insight:** npm provenance/SLSA attestations only prove the authorized workflow produced a package, not that the triggering commit was legitimate — audit branch push permissions and commit identities (placeholder 'Your Name <you@example.com>', unsigned commits) as the real trust boundary, and diff-pad detection (thousands of leading spaces) reveals hidden payloads.