On July 14, 2026, the AsyncAPI ecosystem faced a significant security breach, marking a coordinated supply chain attack that compromised its npm (Node Package Manager) infrastructure. This incident was characterized by the introduction of a malicious backdoor associated with Miasma, executed via trusted workflows managed through GitHub Actions. This breach raised serious concerns about the integrity of developer environments and CI/CD (Continuous Integration/Continuous Deployment) processes, as it enabled unauthorized remote access and the potential for credential theft and lateral movement within the affected systems.
The attack involved the distribution of malicious versions of various packages under the AsyncAPI umbrella, specifically targeting libraries such as @asyncapi/[email protected], @asyncapi/[email protected], @asyncapi/[email protected], and @asyncapi/[email protected]. Collectively, these packages garnered approximately 2.9 million downloads every week, exposing a vast number of developers to exploitation.
What made this breach particularly insidious was that the backdoor was integrated into runtime modules, triggering activation not at the time of installation but when an affected package was imported. This method allowed for a “silent” execution, meaning that the malicious code could run undetected during build processes, documentation generation, or CI/CD jobs, long after the initial dependency resolution had taken place.
Remarkably, the attackers exploited AsyncAPI’s own OIDC (OpenID Connect)-based workflows to deploy these compromised artifacts that appeared indistinguishable from legitimate releases. This level of subversion highlights a sophisticated attack strategy, which exemplifies what experts have termed “provenance-preserving compromise.” In this scenario, although the pipelines used to deliver the software were authentic and legitimate, the underlying commits and workflows had been tampered with.
The deployed backdoor utilized a Miasma-associated Node.js loader, which initiated a detached process pulling an encrypted second stage directly from the InterPlanetary File System (IPFS). This method aligns with previous waves of Miasma attacks on the npm ecosystem. Analysis from JFrog elaborates on the Remote Access Trojan (RAT)-style capabilities that come with this compromise, including persistence, remote command execution, file management, and the ability to update payloads. The attackers further integrated the use of an Ethereum smart contract, acting as an updatable configuration store, to expose alternate communication endpoints, Nostr relays, and BitTorrent DHT (Distributed Hash Table) bootstrap nodes. This facilitated the potential for ongoing, stealthy control even after the packages had been published.
Interestingly, the codebase retained some worm-like traits, incorporating elements that could enhance its spread into other packages. However, the focus of the AsyncAPI configuration primarily served as a remote-access tool rather than functioning as a fully autonomous worm across all environments. This differentiation bears significance for incident responders, as it emphasizes that execution and command-and-control interactions are more reliable indicators of compromise than merely tracking download counts.
According to a report from Cato Networks shared with GBhackers, the attackers capitalized on vulnerabilities within AsyncAPI’s GitHub Actions workflows to gain unauthorized push access. This allowed them to publish tainted releases under the trusted @asyncapi namespace undetected. The AsyncAPI incident fits within a broader tapestry of supply chain attacks in 2026 involving groups such as TeamPCP and Mini Shai-Hulud, which also targeted crucial development tools and package ecosystems.
Earlier in March 2026, TeamPCP had been implicated in similar compromises affecting tools like Trivy and KICS, with a particular focus on leveraging already-trusted components within cloud and build pipelines. By the following months, Mini Shai-Hulud expanded its reach across various ecosystems, including npm, PyPI (Python Package Index), and Packagist. This systematic exploitation saw an increase in the harvesting of developer credentials and CI/CD identities.
Furthermore, the pattern of subsequent attacks indicated the introduction of Miasma into @redhat-scoped npm packages, where attackers adopted techniques such as the Phantom Gyp method. This involved the use of malicious binding.gyp files to allow execution at installation time without employing obvious lifecycle hooks within the package.json file, impacting numerous packages across hundreds of versions.
Attribution for these attacks remains ambiguous. The shared tactics and codebases suggest some level of operational continuity; however, the open availability of Mini Shai-Hulud’s codebase enables a diverse range of actors to repurpose the tools for their malicious goals. Cato CTRL’s supply chain intelligence agent plays a crucial role in monitoring this landscape by correlating affected packages, identifying malicious versions, and assessing infrastructure indicators.
In response to the AsyncAPI breach, Cato’s agent prioritized the incident for rapid analyst review and successfully validated the Miasma command-and-control IP address. Within hours, this led to the addition of the compromised address to Cato’s global blocklist and implemented network-level defenses across the Cato Secure Access Service Edge (SASE) Cloud Platform.
This incident starkly illustrates how proactive, agentic intelligence coupled with globally distributed controls can effectively shorten the timeline from initial disclosure to actionable protection, even against resilient infrastructures such as IPFS and Ethereum contracts. Organizations that utilized or executed the affected AsyncAPI versions are urged to scrutinize their developer workstations, CI/CD runners, and build environments for possible exposure.
In addition to identifying vulnerable versions in manifests, organizations must ascertain if any compromised modules were imported and search for any detached Node.js processes. They should analyze outbound connections carefully and rotate credentials used within these environments. Given the campaign’s reliance on IPFS, BitTorrent, and similar services, it’s advisable for defenders to implement policy-driven restrictions where appropriate to mitigate future risks.