M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

Detect and mitigate malicious @asyncapi npm packages linked to the latest npm supply chain attack.

On July 14, 2026, an attacker opened 37 pull requests to the AsyncAPI generator repository. Almost all attempted to add a fake charity donation page. Camouflage in the noise, a single PR exploiteda misconfigured GitHub Actions workflowto steal a highly privileged Personal Access Token.

Four malicious npm packages (five total versions) were published under the@asyncapinamespace. The packages contain a multi-stage payload that establishes persistence and connects to command and control infrastructure. Combined, these packages see over three million downloads a week. In this case, the payload executes on import/require, not install.

This does not appear directly connected to the previous compromise of@asyncapiin the Shai-Hulud 2.0attack.

The attacker exploited a vulnerability class known as a "pwn request" in GitHub Actions. Theasyncapi/generatorrepositorycontained a workflow filethat usedpull_request_targetto trigger on pull requests, but then checked out the pull request's code rather than the base branch.

This is dangerous becausepull_request_targetruns in the context of the base repository with full access to secrets. When the workflow checks out attacker-controlled code from the pull request and executes it, those secrets become accessible.Unfortunately, the potential for this vulnerabilityhad been identified months before the attack. On April 29, a contributoropened a PR investigating the issuewith a proof-of-concept payload. On May 17, theyfollowed up a proposed fixthat split the workflow into two separate jobs to isolate secret access from untrusted code. That fix was still open, unmerged, when the attacker struck 58 days later.At 05:08 UTC, the attacker openedPR #2155containing a markdown file with obfuscated JavaScript hidden after approximately 1,000 bytes of whitespace. The payload was designed to scan the GitHub Actions runner's environment for secrets and exfiltrate them to a dead-drop URL on the rentry.co pastebin.

Automated review flagged the obfuscation and while the PR was never merged, the damage was already done. The workflow completed at 05:16 UTC and the attacker was able to retrieve the stolen credentials.

The compromised token appears to be a PAT belonging toasyncapi-bot, a service account with access across the AsyncAPI organization.

Using the stolen PAT, the attackerpushed a malicious commit directly to the `next` branch at 06:58 UTC. This triggered the release workflow, which published the initial three compromised packages to npm at 07:10 UTC.

The attacker then pivoted to theasyncapi/spec-json-schemasrepository, pushing 11 commits between 07:51 and 08:28 UTC. Two additional malicious versions of@asyncapi/specswere published.

All five versions contain the same payload injected into different files. The malicious code is hidden on the first line of legitimate source files, padded with whitespace to push it off-screen in most editors.

The payload shares some technical characteristics with the Miasma malware framework previously documented in supply chain attacks. The obfuscation layer usesjavascript-obfuscatorwith a custom base64 alphabet, the same configuration seen in prior incidents.

The Stage 3 runtime explicitly self-identifies as"M-RED-TEAM v6.4"in code comments describing beacon encryption and C2 communication protocols. The extracted configuration file setsgiteaPackagesOrgto"miasma-test-org."The payload usesmiasma-monitor.servicewithin the persistence code. The Nostr relay C2 uses"miasma”branded tags.

However, the Rentry dead-drop URL uses the slug"elzotebo,"matching naming patterns from theprt-scancampaign, which has been linked to previous pull request-based attacks. Theprt-scancampaign has not been linked to Miasma.

Beyond the references and initial obfuscation method the payload contains minimal resemblance to previous Miasma and Shai-Hulud payloads. Instead of a worm, it appears to contain a fully fledged commands framework with classic Trojan capabilities (Dirlist,GetFile,PutFile, etc.) with a direct connection to command and control infrastructure.

At this time, we are not making any definitive attribution.

The payload follows a staged infection chain:

The first stage is executed on package import.  It spawns a detached child process that downloads the next stage from IPFS, saving it to a platform-specific directory:

Linux:~/.local/share/NodeJS/sync.js

macOS:~/Library/Application Support/NodeJS/sync.js

Windows:%LOCALAPPDATA%\NodeJS\sync.js

The second stage  is an 8.25 MB encrypted bundle retrieved from IPFS. It contains configuration data and the main runtime.

The third stage is a 92,000-line malware framework with modular architecture. It establishes persistence via systemd user services on Linux and communicates with command and control infrastructure over multiple channels including HTTP, Nostr relays, Ethereum smart contracts, and a libp2p mesh network.

The payload includes credential theft capabilities targeting browser saved passwords and cookies (Chrome, Brave, Firefox, Edge), SSH keys, npm and GitHub tokens, AWS credentials, macOS Keychain, and cryptocurrency wallets. Once installed, the malware appears to accept remote commands for file operations, directory listing, and data exfiltration.

Wiz detected this attack through its automated malicious package monitoring system and immediately added hash-based detection to its reputation database followed by advisory release and package based detection, enabling rapid protection for Wiz customers before broader disclosure.

Organizations should immediately investigate developer workstations, CI/CD environments, and repositories for signs of compromise. Teams should audit systems for the affected packages.

Because the malware targets developer credentials and secrets, organizations should assume potential exposure of GitHub tokens, SSH keys, cloud credentials, and CI/CD secrets, and rotate them accordingly.

Finally, organizations should strengthen software supply chain defenses by implementing dependency allowlisting, SBOM generation, package verification, and improved monitoring of developer and build environments.

Wiz customers should refer tothe pre-built advisoryin the Wiz Threat Intel Center for actionable steps to investigate, remediate, and harden their environments. Wiz Research will continue to update that advisory as the situation develops.

Rethinking IaC coverage as a funnel that shows how much of your infrastructure is governed, traceable, and ready for remediation at speed

Automation, resilience, and security for the modern age

Verizon's latest DBIR highlights how attackers are exploiting familiar weaknesses at increasing speed and scale. Here's what Wiz research reveals about vulnerabilities, trust relationships, and AI in modern cloud environments.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings