Attackers compromised the @asyncapi npm organization by abusing a misconfigured GitHub Actions workflow, then republished multiple AsyncAPI-related packages with a hidden loader. The malware ran automatically when the poisoned packages were imported (not during install), pulled a second-stage payload from IPFS, and connected to command-and-control infrastructure. This incident could expose developer machines and CI/CD environments that built or ran code during the brief exposure window.
The compromise began not with a stolen credential but with a pull request. Attackers submitted a PR to the asyncapi/generator repository that targeted a docs-preview automation workflow. That workflow used pull_request_target while also checking out the untrusted head commit of the PR, combining two unsafe choices that placed attacker-controlled code inside the base repository's privileged security context. The submitted content was designed to fetch and evaluate remote JavaScript, giving the attacker a foothold to eventually publish poisoned versions of AsyncAPI-related npm packages.
From there, five versions across four packages were republished with a hidden loader. When any downstream build or application imported one of these packages, the injected code ran immediately, spawning a child process that downloaded a second-stage payload, sync.js, from a public IPFS gateway and connected to command-and-control infrastructure.
Several factors let this campaign slip past common defenses. The malicious code executed at module-load (import/require) time rather than during install, so the widely used npm install --ignore-scripts mitigation had no effect. The poisoned packages were also published through the project's legitimate GitHub Actions OIDC release workflow, which meant the resulting artifacts carried valid provenance signatures accurately tied to the real repository, commits, and workflow, even though the triggering commits themselves were unauthorized. This shows that verified publishing pipelines and signed provenance can still carry compromised code if the upstream automation is manipulated.
Teams that build or maintain open source tooling should treat pull request automation as a high-risk entry point and avoid running untrusted PR code with access to secrets or privileged tokens. Because valid provenance does not guarantee a safe build, organizations should monitor for import-time execution patterns and unusual child processes rather than relying solely on install-time protections. If a build system or developer workstation imported a compromised version, credentials and secrets should be rotated from a clean host, and npm and Yarn caches should be purged along with a search for the sync.js artifact across affected environments.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A malicious pull request targeted a docs-preview workflow that used pull_request_target and checked out untrusted PR code, giving the attacker's content access to the base repository's security context and enabling code execution.
No. The malware executed at module-load time when the package was imported or required, not during install, so the common --ignore-scripts mitigation did not prevent it.
Yes. The legitimate GitHub Actions OIDC release workflow published the poisoned packages with valid provenance signatures, even though the underlying commits were unauthorized.
Remove all affected versions, purge npm and Yarn caches, hunt for the sync.js payload, and rotate credentials from a clean host since second-stage execution can expose tokens.
Imagine this: you just import an AsyncAPI package… and that import is what pops a shell on your build server. In the AsyncAPI incident, a malicious GitHub pull request hit a docs-preview workflow using pull_request_target, checked out untrusted PR code, then published poisoned npm packages with valid provenance under npm-oidc-no-reply@github.com. Here’s the twist: these packages don’t fire on install. When your app imports them, hidden code spawns a Node.js child process, pulls sync.js from IPFS, and quietly talks to 85.137.53.71 over ports like 8080 and 8081. If your builds or workstations ever pulled a compromised AsyncAPI version, treat it like secrets are exposed: from a clean machine, rotate your tokens and credentials. That’s the move.
Researchers found nearly 800 malicious npm packages that trick developers into installing them through typo-squatted package names and believable documentation. Instead of auto-running on install, the packages rely on the developer following README instructions to load the module, which then…
A Japanese industrial manufacturer was targeted by the SilverFox group using an invoice-themed phishing email that kicked off a multi-stage malware chain. The campaign abused legitimate software and cloud services to load a malicious DLL, disable security tools, and establish remote access with…
Cisco Talos reports a real campaign by a Russian-speaking group (UAT-11795) targeting users in the U.S. and Europe with trojanized installers for popular tools like Zoom, Webex, and MobaXterm. Victims are socially engineered via a “ClickFix” style trick into running a command that silently…
A real, ongoing phishing campaign is tricking recipients into opening malicious archives that appear to contain harmless TrueType font files (.ttf) but actually hide a Lua-based loader. Once executed, the loader uses stealthy, mostly in-memory techniques to install remote access trojans and…
CrowdStrike reports attackers increasingly bypass security tools by using trusted login paths, phone-based IT impersonation, and abuse of legitimate cloud and AI services. The report highlights real intrusions where vishing led to single sign-on takeovers and rapid data theft, and where attackers…
Researchers say a law firm was targeted with a spear‑phishing email that led staff to download an encrypted archive containing a Windows shortcut labeled like legal case files. After the user ran it and approved admin rights, the malware told Microsoft Defender to ignore a folder and a fake…
