AsyncAPI npm packages, widely used in development environments, have been compromised in a recent supply chain attack. The breach involved five trojanized package releases, collectively downloaded nearly 2.9 million times each week. This incident poses significant risks to development workstations and build servers that integrated the affected modules.
The attack originated from the AsyncAPI generator repository, where a GitHub Actions workflow with the pull_request_target trigger was exploited. This setup inadvertently exposed repository secrets when external pull requests were checked out. The attacker used this vulnerability to send an npm publishing token to an external site, rentry.co, subsequently releasing altered packages.
Security firm Aikido identified the breach on July 14, tracing it back to a weakness in the workflow, which allowed the insertion of a remote-access implant. Importing, rather than just installing, the affected packages could initiate a harmful infection chain. The injected code downloaded an encrypted Node.js loader and executed it as a detached process.
The payload established persistence, allowing attackers remote access to collect data and execute commands. Although functions for credential theft and self-replication existed in the malware, they were disabled in the observed instance. The compromised packages include asyncapi-specs 6.11.2 and 6.11.2-alpha.1, asyncapi-generator 3.3.1, asyncapi-generator-helpers 1.1.1, and asyncapi-generator-components 0.7.1.
The malicious code was deeply embedded in standard runtime modules, making detection challenging. It placed payloads in user-specific NodeJS directories across different operating systems. The malware also contacted a command-and-control server every 30 seconds, even with reconnaissance features turned off.
To mitigate the impact, organizations are advised to downgrade to earlier, uncompromised versions of the packages and remove the affected releases from all systems. Security teams should isolate and examine systems that used these modules, rotate sensitive credentials, and investigate network connections to known malicious servers.