Originally published on open-source project, resulting in the publication of malicious versions of several popular repositories to inject a multi-stage malware loader that deploys the Miasma RAT. The attack is notable for its method: by committing malicious code to a development branch, the attackers abused the project's legitimate CI/CD workflow, powered by ): The attacker leveraged the trusted, automated CI/CD pipeline as a distribution mechanism. This is a form of Living-off-the-Land, but within the development infrastructure. This attack highlights a critical flaw in relying solely on publisher identity verification, like OIDC provenance. While provenance proves who published a package, it cannot prove the integrity of the code within it. If the publisher's build process is compromised, it will simply sign and attest to malicious code. The impact of this attack is significant and multi-faceted: Security teams may want to hunt for the following patterns to detect potential compromise:
Impact Assessment
Developer Compromise: Any developer who downloaded and used the malicious package versions could have their machine compromised by the Miasma RAT.
Downstream Risk: Applications and services built using the compromised packages could be affected. The Miasma RAT could be active in production environments if the malicious packages were deployed.
Data Exfiltration: Compromised systems are at risk of having source code, environment variables, cloud credentials, and other sensitive developer secrets stolen.
Erosion of Trust: This attack undermines trust in the open-source ecosystem and the security of automated package management and CI/CD pipelines.
IOCs — Directly from Articles
Type
Value
Description
NPM Package
@asyncapi/[email protected]
Malicious version
NPM Package
@asyncapi/[email protected]
Malicious version
NPM Package
@asyncapi/[email protected]
Malicious version
NPM Package
@asyncapi/[email protected]
Malicious version
Cyber Observables — Hunting Hints
Type
Value
Description
File Name
package-lock.json, yarn.lock
Search for the specific malicious package versions listed in the IOCs.
Network Traffic Pattern
Outbound connections from build agents
Monitor for unexpected network connections from CI/CD runners or developer machines to unknown IP addresses, especially shortly after a build process.
Process Name
node
Look for node processes that spawn unexpected child processes or make unusual network connections, particularly in the context of a CI/CD job.
Command-line Pattern
npm install or npm ci
While the payload doesn't run on install, logs of these commands can establish a timeline for when the malicious packages might have been introduced.
Detection & Response
npm audit may help, but manual inspection of lock files is recommended.
node processes, or the presence of the Miasma RAT.
Mitigation
main, release) with branch protection rules, requiring signed commits and multiple reviewers.
package-lock.json, yarn.lock) to ensure that builds are reproducible and use specific, vetted package versions. This is a form of .
🔧 Programmierung 🕛 kürzlich 5 Min Lesezeit
AsyncAPI Supply Chain Attack Delivers Miasma RAT via NPM
📑 Inhaltsübersicht
Vollständiger Original-Bericht
Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf dev.to.
Wie bewertest du diesen Beitrag?
1 Klick Feedback Teilen mit Netzwerk & Team:
Hat Ihnen dieser Tipp / Anleitung geholfen?
Community-Analysen & Experten-Meinungen 0
Verfasse deine eigene Analyse, teile Workarounds oder diskutiere diesen Vorfall im Blog.
Noch keine Community-Analyse verfasst. Markiere einen Textabschnitt oder klicke oben auf „ Eigene Analyse verfassen“!
Community Pulse: Relevanz-Einschätzung
1 Klick Experten-Votum 🔴 Akute Relevanz 0%
🟡 In Evaluierung 0%
🟢 Keine Auswirkung 0%
Spannende Innovation 0%
Verwandte Story-Cluster & Quellen (Vektor-KI)
Tipp: Mit Pfeiltasten [ ← ] und [ → ] blättern
SOCIAL SHARE CARD GENERATOR