{
  "name": "Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery",
  "slug": "unpacking-the-asyncapi-npm-supply-chain-compromise-and-import-time-payload-delivery",
  "description": "On July 14, 2026, a coordinated supply chain attack compromised the @asyncapi npm organization, affecting five package versions across four packages. The attack originated from a GitHub Actions workflow vulnerability that exposed privileged credentials, enabling unauthorized code injection. Unlike typical postinstall attacks, this campaign executes at module import time, bypassing common npm install --ignore-scripts protections. The malicious code spawned hidden processes that fetched a second-stage payload from IPFS, deploying the Miasma modular runtime with command-and-control capabilities, persistence mechanisms, and credential harvesting features. The payload included disabled modules for supply-chain propagation, AI-tool poisoning, and sandbox evasion. All compromised packages were published through legitimate GitHub OIDC workflows with valid provenance signatures, masking the malicious activity within trusted release processes.",
  "published": "2026-07-16T06:59:08.065000+00:00",
  "created_at": "2026-07-16T10:40:16.151000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-16T10:40:16.151000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "asyncapi",
    "bluerabbit",
    "gigawiper",
    "miasma",
    "npm compromise"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "7dd6c423-e2d6-4896-b53d-94db8d70b49a",
        "name": "9b2e65db653ca8575c9b10eefb9a80c6006404812c2ec212bf5675e3c690233b"
      },
      {
        "id": "e6ac2c81-4bad-4f75-a06a-bb17b8faa585",
        "name": "082d733db0687dcd768104972b065d4b58cb1e6043688c6c20fa3702337f36ab"
      },
      {
        "id": "cff680fc-09e7-4e82-b811-641a9b4cd5a6",
        "name": "34014776d3d3ff11bc4439b02fd7ac0f02a887eb3a052eeafff236e2f6db8ad1"
      },
      {
        "id": "5d8668ba-0f89-477a-82ea-888452c53335",
        "name": "8351d251cf0b5a0bd82242deaa0a14e3e1394418d55c0f4259dac4303b79fc0c"
      },
      {
        "id": "e4ed3f14-1dea-438c-a0bc-b25cf395b28d",
        "name": "85.137.53.71"
      },
      {
        "id": "5e1d7135-fd73-42d4-bb89-d59f963eebe3",
        "name": "d425e4583cc6185d41e95c45eda00550045a5d1919b9a012236a4520d009dbd7"
      },
      {
        "id": "a0b9bad2-4997-4eef-b3c8-a955cdbec0ea",
        "name": "bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4"
      }
    ],
    "attack_patterns": [
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "d3254e3b-07e6-4420-96e0-2e107ce17712",
        "name": "T1102.001"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "e615d5ec-8d67-4048-b21d-a5fb09925bb9",
        "name": "T1552.001"
      },
      {
        "id": "e87116ac-f56b-4b15-a5e2-a4ed737555d5",
        "name": "T1543.002"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "97cda0df-73f8-46ac-9b12-ba9b7f4032ab",
        "name": "T1552.007"
      },
      {
        "id": "880d45b0-e336-4f1a-8893-2796195f5500",
        "name": "T1543.001"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "1d0d9e67-eb8a-439c-a2c7-cab311bb25c4",
        "name": "T1195.002"
      },
      {
        "id": "45bf8bb0-9e32-433d-86b3-31fb50d352d9",
        "name": "T1547.004"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "6f00068c-812c-4e2b-9100-2cfa86b3aed9",
        "name": "T1132.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "ce39cd5d-9e4c-4138-b546-abd68e57f8c2",
        "name": "T1071.004"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "malware": [
      {
        "id": "2c552809-98ce-437e-a978-47bf6eaf6e0f",
        "name": "GigaWiper",
        "slug": "gigawiper"
      },
      {
        "id": "2f504a89-03b5-446f-9820-2df5e962a0d1",
        "name": "Miasma",
        "slug": "miasma"
      },
      {
        "id": "6e34978e-06e8-4961-8997-283d224faa96",
        "name": "BLUERABBIT"
      }
    ],
    "observables": [
      {
        "id": "e1e391bf-5660-4b52-9616-64eb3aa2b658",
        "name": "85.137.53.71"
      }
    ]
  },
  "external_refs": [
    {
      "id": "ec7a61c2-c0e9-4fe5-8854-0f42e8719d5e",
      "standard_id": "external-reference--1df5196b-9bbe-5864-9b01-58dca3df2ce0",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a58813c09a76d1819c69bb0",
      "hash": null,
      "external_id": "6a58813c09a76d1819c69bb0",
      "created": "2026-07-16T10:40:13.350Z",
      "modified": "2026-07-16T10:40:13.350Z",
      "createdById": null
    },
    {
      "id": "02d5db47-c870-4771-9988-e676ea74260c",
      "standard_id": "external-reference--4ce80036-3520-5c3a-86cf-9c91dd099332",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.microsoft.com/en-us/security/blog/2026/07/15/unpacking-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery/",
      "hash": null,
      "external_id": null,
      "created": "2026-07-16T10:40:13.403Z",
      "modified": "2026-07-16T10:40:13.403Z",
      "createdById": null
    }
  ]
}