Compromised AsyncAPI npm Packages: CI/CD Attack and the Miasma Loader

Colleagues, I’d like to flag a cybersecurity incident: compromised @asyncapi packages have been found in npm.

A key detail is worth noting: the malicious versions were published through a legitimate GitHub Actions release pipeline via trusted-publisher/OIDC, rather than with a stolen npm token.

The code does not trigger on install; it activates on require() and launches a multi-stage loader associated with Miasma.

All malicious versions have now been revoked, but any host where these packages were downloaded or executed should be treated as potentially compromised.

Why this matters: supply chain attacks increasingly bypass conventional checks and target builds, CI/CD, and developer environments.

How do you assess trusted-publisher risk in your processes?

#cybersecurity #supplychain #npm #CI_CD