Cato CTRL™ Threat Brief: AsyncAPI Supply Chain Attack Delivers Miasma Malware Through Trusted npm Packages
Executive Summary
On July 14, 2026, attackers compromised release processes connected to the AsyncAPI open- source project and published malicious versions of four widely used npm packages with a combined reach of approximately 2.9 million weekly downloads. The affected releases delivered a Miasma-associated Node.js payload designed to establish persistence and communicate with attacker-controlled infrastructure, creating potential exposure across developer workstations, CI/CD runners, documentation systems, and automated build environments.
Cato CTRL identified the incident through its supply chain intelligence agent, which continuously monitors security research and software ecosystem disclosures, correlates findings across sources, and extracts actionable data such as affected packages, malicious versions, campaign context, and network indicators. The agent prioritized the AsyncAPI activity for analyst review, enabling Cato researchers to validate the known command-and-control IP address, add it to Cato’s global blocklist, and initiate network-level enforcement across the Cato SASE Cloud Platform within only a couple of hours.
What Is AsyncAPI?
AsyncAPI is an open-source specification and tooling ecosystem for designing and documenting asynchronous and event-driven APIs. It is commonly used with technologies such as Apache Kafka, MQTT, AMQP, and WebSockets.
The AsyncAPI Generator and related packages can transform API definitions into documentation, source-code templates, diagrams, and application scaffolding. These tools may run on developer workstations or inside CI/CD pipelines.
Because these environments often contain source-control tokens, cloud credentials, publishing permissions, SSH keys, and deployment secrets, compromising an AsyncAPI component can expose systems far beyond the affected npm package itself.
2026 Cato CTRL™ Threat Report | Download the report
Affected npm Packages
The affected packages account for approximately 2.9 million weekly downloads, with @asyncapi/specs representing most of that volume. Download counts do not indicate confirmed infections, but they demonstrate the potential reach of the compromised releases, particularly in environments that automatically restored or updated dependencies during the exposure window.
July 14: The AsyncAPI Compromise
The incident timeline and attack-chain analysis below draw on complementary findings from Chainguard, Aikido, SafeDep, Wiz, and Cloudsmith.
GitHub Actions as the Initial Access Path
Researchers reported that a vulnerable GitHub Actions configuration allowed untrusted pull-request content to interact with a privileged workflow context. The attacker used this access to obtain or abuse an AsyncAPI automation identity and make unauthorized repository changes.
Unauthorized Repository Changes
The attacker pushed malicious code to a branch connected to AsyncAPI’s release process. The change was designed to resemble routine development or release activity and triggered the project’s legitimate automation.
Malicious Packages Published Through Trusted Automation
AsyncAPI’s own publishing workflows then released the modified packages through the official npm namespace. Because the packages came from legitimate project automation, they could appear more trustworthy than packages published through a newly created or unrelated account.
How the Malicious Code Executed
The injected JavaScript did not use standard npm lifecycle scripts. It ran when an affected module was imported, meaning the malware could remain inactive after installation and execute later during a build, documentation task, application run, or CI/CD job.
Miasma Payload Behavior
The first-stage code launched a detached Node.js process and retrieved an encrypted second-stage payload from IPFS. According to JFrog’s analysis, the payload supported persistence, remote command execution, file operations, payload updates, and command-and-control communications.
Cato examined the Ethereum contract referenced by the malware and confirmed that it functioned as an updatable store for command-and-control configuration, including alternative endpoints, relay infrastructure, and bootstrap data. External reporting indicates that the contract was used as a fallback mechanism when direct HTTP communication was unavailable. As shown in Figure 1, the stored configuration included versioned endpoint groups, Nostr relay addresses, and BitTorrent DHT bootstrap nodes that could be updated without republishing the compromised npm packages.
The analysis also identified an earlier, nearly identical contract at 0x1969ab05d67b67fdcaa26240f738ccb077e1cd84. Because queries to that contract did not return the same usable configuration data, its purpose could not be confirmed and it may have been used for testing or staging. Cato also identified an additional IPFS content identifier, QmQtjE6NCaMGbcWvczuASpXTakZYrE6AmjnCnCdp8wHAo1, however, the associated content was no longer retrievable at the time of analysis, so its role remains unknown.
Figure 1. Ethereum-based fallback configuration used by Miasma
Although the code included worm-like functionality, the configuration examined in the AsyncAPI incident primarily behaved as a remote-access tool. It is therefore more precise to describe it as a Miasma-associated RAT rather than assuming full self-propagation in every affected environment.
Miasma, Mini Shai-Hulud, TeamPCP, and AsyncAPI: Similar Tactics, Uncertain Relationships
AsyncAPI is the legitimate project that was compromised. Mini Shai-Hulud and Miasma refer to malware and campaign activity targeting software packages, developer credentials, and CI/CD environments. TeamPCP is a threat cluster linked by researchers to earlier supply chain compromises involving trusted development tools.
The campaigns share code concepts, targeting patterns, and an interest in software-publishing identities. However, public availability of Mini Shai-Hulud-related code makes attribution more difficult because other actors can reuse or modify it.
The available evidence supports a relationship in tooling and operational methods, but it does not conclusively prove that TeamPCP conducted the July AsyncAPI attack.
From TeamPCP and Mini Shai-Hulud to Miasma
March 2026: TeamPCP-Linked Supply Chain Activity
Earlier in 2026, researchers linked compromises involving Trivy, the KICS GitHub Action, LiteLLM, and other development tools to TeamPCP. Cato documented this activity in TeamPCP: Supply Chain Attack Targets Trivy, KICS GitHub Action, and LiteLLM, showing how attackers targeted software components already trusted inside cloud and development environments.
April and May 2026: Mini Shai-Hulud Expands
By late April and May, Mini Shai-Hulud was affecting packages across npm, PyPI, Packagist, and other ecosystems. According to the Cloud Security Alliance, the campaign focused on developer credentials, package-publishing access, cloud identities, and CI/CD environments.
May 19: AntV npm Packages Compromised
Attackers compromised packages associated with the AntV visualization ecosystem and published malicious npm versions. Microsoft’s analysis found that the payload targeted credentials associated with GitHub, npm, AWS, Kubernetes, Vault, 1Password, and Linux-based CI/CD runners.
June 1: Miasma Targets Red Hat-Scoped Packages
Upwind reported that Miasma-related malware appeared in packages under the @redhat-cloud-services npm scope. The payload searched for cloud, source-control, CI/CD, and publishing credentials and contained functionality intended to help the campaign expand into additional packages.
June 4: Miasma Introduces Phantom Gyp
A later Miasma wave used malicious binding.gyp files to execute code during package installation without relying on an obvious lifecycle entry in package.json. Semgrep reported that the campaign affected 57 packages and more than 286 malicious versions, while SOC Prime referred to the technique as Phantom Gyp.
July 14: Miasma Reaches the AsyncAPI Ecosystem
The AsyncAPI incident introduced a different delivery chain. Instead of relying on the June installation techniques, attackers abused GitHub Actions, repository access, and trusted release automation to publish malicious packages through the official AsyncAPI namespace.
Why This Incident Matters
The affected packages have a combined footprint of approximately 2.9 million weekly downloads and may run in environments containing sensitive development and cloud credentials. Even limited exposure could therefore create opportunities for repository compromise, credential theft, cloud access, or additional supply chain activity.
The execution method also matters. Because the payload activated when a module was loaded rather than through a conventional npm installation script, a package could remain dormant until used by a developer or build process. Security teams must therefore determine whether an affected version was executed, not only whether it was downloaded.
The incident also highlights the limitations of trusted publishing and provenance. A package can be produced by the correct repository and workflow while still containing malicious code if an attacker has already compromised the source, branch, workflow, or automation identity.
Cato Assessment and Protection
Cato continuously monitors public and proprietary intelligence sources for compromised software packages, malicious infrastructure, and emerging supply chain campaigns.
Within hours of the AsyncAPI reports surfacing, Cato’s supply chain intelligence agent aggregated the relevant research and provided Cato researchers with the affected package versions, payload indicators, known command-and-control endpoints, and supporting technical sources.
We validated the indicators, added the identified Miasma command-and-control infrastructure to Cato’s global blocklist, and triggered distribution of the updated protection across Cato Points of Presence.
We added the known Miasma command-and-control IP address identified in this campaign to its global blocklist, enabling network-level enforcement against that infrastructure. This response demonstrates how agentic threat intelligence and globally distributed enforcement can accelerate the transition from emerging intelligence to customer protection, while broader detection remains necessary for malicious content hosted on widely used services.
Recommended Actions
Organizations that installed or resolved an affected package should:
- Identify the affected versions in manifests, lockfiles, caches, and build artifacts.
- Determine whether the packages were imported or executed.
- Search for the NodeJS/sync.js payload and suspicious detached Node.js processes.
- Review outbound connections, repository audit logs, and CI/CD activity.
- Rotate credentials accessible to affected developer or CI/CD environments.
- Review privileged GitHub Actions workflows, particularly those using pull_request_target.
Cato customers should also consider the following controls, where operationally appropriate:
- Block access to ipfs[.]io in the Cato Management Application if IPFS is not required for legitimate business use.
- Block BitTorrent traffic and monitor for the full signature range: cid_heur_bittorrent, cid_heur_bittorrent_1, cid_heur_bittorrent_2, cid_heur_bittorrent_3, cid_heur_bittorrent_4, and cid_heur_bittorrent_5.
- Restrict access to rentry[.]co and other pastebin-style services unless they are required for approved business activity.
Conclusion
The AsyncAPI incident demonstrates how attackers can use trusted release automation to distribute malware through legitimate software channels. The malicious packages appeared under the correct npm namespace, were published by authentic workflows, and executed without relying on a conspicuous npm installation script.
Cato’s supply chain intelligence agent identified the relevant intelligence within hours, enabling researchers to validate and block the known Miasma command-and-control infrastructure on the same day. The incident reinforces the need to combine secure development practices, supply chain monitoring, credential protection, and rapid network-level enforcement.
The post Cato CTRL™ Threat Brief: AsyncAPI Supply Chain Attack Delivers Miasma Malware Through Trusted npm Packages appeared first on Cato Networks.
