A massive supply-chain attack has compromised five versions of AsyncAPI packages on the Node Package Manager (npm), delivering a remote access trojan with info-stealing capabilities to over 2.25 million users. The threat actor exploited a misconfigured GitHub Actions workflow, injecting malware into project files and publishing trojanized packages in the @asyncapi namespace.
The malicious packages, which include @asyncapi/generator, @asyncapi/specs, and others, were pushed to npm on July 14, with the attacker using a placeholder git identity to avoid detection. The infected packages had legitimate SLSA provenance attestations, making them appear as if they came from an authorized workflow. This is a concerning development, as it highlights the ease with which attackers can compromise even seemingly secure workflows.
The malicious payload, which includes a downloader and a second-stage script, ultimately establishes persistence on the system and communicates with a command-and-control (C2) server over multiple channels. The malware appears to be designed to steal secrets, including credentials, authentication keys, tokens, browser data, sensitive info from CI/CD systems, AI developer tools, cryptocurrency wallets, and databases.
However, a report from cybersecurity company Aikido notes that the data harvesting tool exits before collecting anything, suggesting that the attackers may have been testing their malware. Nevertheless, the researchers emphasize that all this can be achieved manually using the shell, making it clear that the threat is real.
The exposure window for the attack was approximately four hours and seven minutes between 07:10 and 11:18 UTC on July 14. As a result, developers are advised to pin to known-good files, regenerate lock files, remove the hidden ‘NodeJS/sync.js’ payload, terminate all malicious processes, and rotate credentials on impacted systems.
This incident serves as a stark reminder of the importance of supply-chain security and the need for developers to be vigilant. With over 2.25 million users potentially affected, it’s crucial that developers take immediate action to mitigate the risk. By pinning packages to known-good files and regularly regenerating lock files, developers can reduce their exposure to such attacks.
In addition to these technical measures, it’s essential for developers to stay informed about the latest security threats and vulnerabilities. Regularly reviewing package dependencies, monitoring for suspicious activity, and staying up-to-date with the latest security patches are all critical steps in protecting against supply-chain attacks like this one.
Source: Bleeping Computer — 2026-07-15