# M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

Attacker exploited a pull_request_target pwn-request workflow in asyncapi/generator to steal asyncapi-bot's PAT, then published five backdoored @asyncapi npm packages with a multi-stage C2 trojan.

- Payout: Real-world hack
- Severity: critical
- Program: AsyncAPI
- Credited: Wiz Research
- Disclosed: 2026-07-14
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/m-red-team-asyncapi-supply-chain-compromise-via-github-actions
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-m-red-team-asyncapi-supply-chain-compromise-via-github-actions
- Tags: domain:oss impact:data-leak impact:integrity impact:mass-exploit kind:incident platform:threat-intel sev:critical tech:github-actions tech:nodejs technique:source-review vuln:secrets-leak

**Target:** GitHub Actions workflow (pull_request_target) and @asyncapi npm packages
**Root cause:** Workflow triggered on pull_request_target (base-repo context with secrets) but checked out and executed the untrusted PR's code, exposing secrets to attacker-controlled code.
**Steps:**
1. Open PR #2155 to asyncapi/generator adding a markdown file with obfuscated JS hidden after ~1000 bytes of whitespace
2. Workflow runs on pull_request_target, checks out PR code, executes payload
3. Payload scans runner env for secrets and exfiltrates to `rentry.co` dead-drop slug `elzotebo`
4. Attacker retrieves asyncapi-bot PAT from dead-drop
5. Push malicious commit to `next` branch at 06:58 UTC triggering release workflow; npm publishes at 07:10 UTC
6. Push 11 commits to asyncapi/spec-json-schemas 07:51-08:28 UTC, publishing two more @asyncapi/specs versions
7. Payload hidden on first line of legit source files, whitespace-padded off-screen
**How found:** Not stated for the attacker; the pwn-request flaw had been identified months earlier by a contributor (PR Apr 29 with PoC, fix proposed May 17 splitting workflow into two jobs) but the fix remained unmerged 58 days until the attack.
**Exploitation:** Stolen asyncapi-bot PAT gave org-wide write access; attacker pushed directly to release branches to trigger automated npm publish of five backdoored versions. Payload executes on import/require: stage 1 spawns detached child downloading stage 2 from IPFS to platform-specific path (~/.local/share/NodeJS/sync.js etc.), stage 2 is 8.25MB encrypted bundle, stage 3 is 92k-line framework with systemd persistence (miasma-monitor.service) and C2 over HTTP, Nostr relays, Ethereum contracts, libp2p. Steals browser creds/cookies, SSH keys, npm/GitHub tokens, AWS creds, macOS Keychain, crypto wallets.
**Escalation:** Single leaked PAT chained into org-wide repo write, then automated release pipeline abuse to publish to npm at scale (~3M weekly downloads), then multi-channel C2 with persistence and credential harvesting.
**Insight:** pull_request_target workflows that checkout PR head are exploitable even when the PR is never merged — the workflow run itself leaks secrets. Also: whitespace-padded first-line payloads evade casual code review; scan diffs for anomalous leading whitespace and check unmerged security-fix PRs as a signal of live exposure.