A supply chain compromise has placed AsyncAPI npm packages at the center of a developer security incident.
Five trojanized releases, with roughly 2.9 million combined weekly downloads, were published after an attacker gained access to an npm publishing token.
The incident creates risk for development workstations, build servers, and environments that loaded the affected modules.
The attack began in the AsyncAPI generator repository, where a GitHub Actions workflow used the pull_request_target trigger. This configuration allowed repository secrets to be exposed when code from an external pull request was checked out.
The attacker opened multiple pull requests and used one to send the npm token to rentry.co before publishing altered packages.
Aikido analysts identified the malicious releases on July 14 and traced the campaign from a workflow weakness to a persistent remote-access implant.
Aikido said in a report shared with Cyber Security News (CSN) that importing an affected package, rather than installing it, could launch the infection chain.
That distinction makes builds and development activity a potential exposure point. The injected code downloaded an encrypted Node.js loader from IPFS, saved it as sync.js, and ran it in a detached process.
The final payload established persistence and offered attackers a remote shell capable of collecting data and running commands. Although credential theft and self-spreading code existed in the bundle, those functions were disabled in the observed build.
GitHub Actions Breach Backdoors AsyncAPI Packages
The compromised versions were asyncapi-specs 6.11.2 and 6.11.2-alpha.1, asyncapi-generator 3.3.1, asyncapi-generator-helpers 1.1.1, and asyncapi-generator-components 0.7.1.
The malicious code was embedded in ordinary runtime modules, including schema exports, validation logic, utility code, and error handling. As a result, a standard require operation could trigger the downloader without an npm lifecycle script.
The two downloader variants retrieved different IPFS objects and placed their payload in a per-user NodeJS data directory.
On macOS, the path used Library/Application Support/NodeJS; on Windows it used LOCALAPPDATA; and on Linux it used .local/share/NodeJS.
The loader then decrypted and evaluated a second-stage component designed to survive beyond the original package execution.
Researchers found that the implant generated a cryptographic key pair, maintained a lock file, and attempted to persist across operating systems.
It added commands to shell startup files on macOS, created a Run registry value on Windows, and wrote a user service file on Linux.
The Linux service appears likely to fail because its execution command lacks a shell wrapper, but the artifacts are still useful evidence during incident response.
Remote Shell Raises Response Stakes
The malware contacted an HTTP command-and-control server about every 30 seconds and sent encrypted beacons.
Even with reconnaissance switched off, those messages contained redacted previews of environment information and checked for configuration files tied to developer tools.
More significantly, the implant could execute shell commands, giving an operator a route to collect sensitive material or move deeper into a network.
Several configuration values appeared to portray the payload as a canary, including safeMode and a five percent setting.
Code analysis showed that these settings did not meaningfully restrict execution: persistence was enabled through a different toggle, and no victim-selection path used the percentage.
The use of HTTP also introduced an additional concern because an attacker positioned on the network path could inject plaintext commands when no encrypted command bundle was present.
Organizations should downgrade to asyncapi-specs 6.11.1, asyncapi-generator 3.3.0, asyncapi-generator-helpers 1.1.0, and asyncapi-generator-components 0.7.0.
They should remove the compromised releases from manifests, lockfiles, caches, internal mirrors, and build images.
Teams should hunt for systems that imported the modules, isolate suspected hosts while preserving volatile data, and examine detached Node processes and persistence artifacts.
Credentials accessible from a developer device or build host should be treated as exposed. Teams should rotate npm tokens, source-control access, cloud credentials, CI/CD secrets, SSH and signing keys, and browser sessions from a clean machine, and rebuild compromised systems.
Network investigations should also review connections to the listed command server, IPFS, Nostr, Ethereum RPC, DHT, and mDNS activity associated with Node processes.
Indicators of Compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
