AsyncAPI npm Supply Chain Compromise Delivers Miasma RAT to 3M+ Weekly Downloads via GitHub Actions 'Pwn Request'

On July 14, Microsoft Threat Intelligence and multiple firms confirmed a coordinated supply chain attack against four @asyncapi npm packages collectively downloaded over 3 million times per week. The attacker flooded the AsyncAPI generator repo with 37 decoy pull requests, camouflaging a single malicious PR that exploited a misconfigured pull_request_target GitHub Actions workflow to steal a privileged PAT — publishing five trojanized package versions with valid SLSA provenance attestations. The payload (Miasma RAT, a.k.a. miasma-train-p1) executes at import time, not install, bypassing npm 12's new install-script blocking; it steals browser credentials, SSH keys, npm/GitHub tokens, cloud credentials, and crypto wallets.

miasma-train-p1) executes at import time, not install, bypassing npm 12's new install-script blocking; it steals browser credentials, SSH keys, npm/GitHub tokens, cloud credentials, and crypto wallets.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.