AsyncAPI npm Package Compromise: Pwn Request Attack Injects Credential-Stealing Malware and Miasma RAT into Supply Chain

Executive Summary

The AsyncAPI npm package ecosystem experienced a sophisticated supply chain compromise in July 2026 when threat actors exploited misconfigured GitHub Actions workflows to inject credential-stealing malware and the Miasma Remote Access Trojan directly into published packages consumed by tens of thousands of developers and enterprise build environments worldwide. The attack vector—a "Pwn Request"—leverages insufficient permission scoping in automated CI/CD pipelines by submitting malicious pull requests to repositories, enabling arbitrary code execution within privileged build contexts and package poisoning at publication time.

Any organization or developer that installed affected AsyncAPI package versions during the exposure window faces confirmed risk of credential exfiltration from build environments and potential persistent remote compromise of systems that executed the malware payload. This incident exposes a structural vulnerability affecting thousands of open-source repositories employing similar workflow configurations.

Immediate actionable guidance: Immediate action required: credential rotation from all affected build environments, integration of Miasma indicators of compromise into detection platforms, and comprehensive audit of GitHub Actions workflows for Pwn Request susceptibility across the enterprise.

What Happened

The "Pwn Request" represents a specific class of supply chain attack that exploits GitHub Actions' automation architecture. Unlike traditional dependency confusion or typosquatting attacks, Pwn Request attacks target the trust relationship between repositories and their CI/CD pipelines by submitting pull requests designed to trigger privileged workflows. When a repository's workflow is configured to execute automatically in response to pull requests—particularly using the `pull_request_target` event—it executes with access to repository secrets, authentication tokens, and environment variables, even when triggered by external contributors. Threat actors exploit this design by crafting malicious pull requests that modify workflow configurations or inject code executed during automated build processes.

In July 2026, attackers submitted a malicious pull request to the AsyncAPI generator repository (`asyncapi/generator`), a critical component of the AsyncAPI tooling ecosystem. AsyncAPI is a specification for describing event-driven and asynchronous APIs; the generator tool transforms AsyncAPI definitions into code, documentation, and deployment artifacts. The tool operates during build processes with access to npm authentication tokens, GitHub credentials, cloud provider API keys, and other sensitive credentials common to development environments. The AsyncAPI repository's GitHub Actions workflow was configured to automatically publish generated npm packages upon successful pull request merge, with insufficient permission scoping. Detection occurred through security research conducted by multiple organizations (Datadog Security Labs, Kodems Security, Aikido Security) monitoring supply chain threats.

The injected malware operated in two distinct functional stages, designed to maximize both immediate intelligence collection and long-term system control. The first stage extracted credentials accessible from the host environment, performing systematic enumeration and exfiltration of npm tokens, GitHub personal access tokens, cloud provider credentials (AWS, Azure, GCP access keys), SSH keys, and environment variables. The second stage deployed the Miasma Remote Access Trojan, a sophisticated RAT enabling arbitrary code execution, file system access, process spawning, and credential store manipulation. Miasma established persistence across system reboots and package updates by embedding itself in system locations resistant to routine software maintenance, enabling undetected interactive access to compromised developer machines and build agents.

Once injected and validated within the AsyncAPI repository's build environment, the malicious code was automatically published to the npm public registry as part of legitimate package releases. The automated publishing workflow executed with full npm registry token permissions, allowing attackers to publish versions bearing authentic AsyncAPI signatures and version numbers. The malware was embedded alongside functional AsyncAPI generation code—a poisoning technique designed to avoid immediate functional detection. The npm registry distributed poisoned package versions to any developer or automated system executing `npm install @asyncapi/generator@[affected-version]` during the exposure window. Given AsyncAPI's adoption in cloud-native, financial services, and event-driven architecture environments, distribution scope was significant, with download metrics indicating tens of thousands of installations spanning North America, Europe, and Asia-Pacific regions during the 48-hour exposure window.

Why It Matters

For Security Practitioners & SOC Teams

The Pwn Request attack class has received insufficient defensive priority relative to its operational exploitability and widespread applicability. The attack requires no sophisticated social engineering, zero-day vulnerabilities, or insider access—only understanding of GitHub Actions' permission model and ability to submit a pull request to a vulnerable repository. Thousands of open-source repositories employ `pull_request_target` workflows combined with elevated permissions for automated publishing or deployment. Each represents a potential compromise point. The vulnerability is structural, not incidental. GitHub Actions workflows execute in response to repository events with access to secrets and tokens, and a pull request modifying the workflow definition or executed code can poison the build pipeline itself. Detection of this attack pattern requires integration of Miasma RAT indicators of compromise into endpoint detection and response platforms, SIEM solutions, and network detection systems.

For Security Leaders & CISOs

AsyncAPI occupies a specialized, high-value position in enterprise architecture, with the generator operating at build time before runtime execution with access to build environment secrets—cloud credentials, package tokens, internal registry credentials. Compromise of generator code represents compromise of the entire build environment, not merely generated output. This attack pattern—targeting build-time tooling rather than runtime dependencies—signals a methodological shift where adversaries increasingly recognize that build infrastructure contains the highest concentration of credential access. Build agents authenticate to cloud providers, package repositories, secret managers, and source control systems. A single compromised build artifact yields access to an organization's entire technology stack. The AsyncAPI incident is the latest in a series of supply chain compromise incidents redefining threat landscape priorities, with XZ Utils, SolarWinds, 3CX, and now AsyncAPI collectively demonstrating that supply chain attacks have transitioned from rare patterns to operationalized, routine threat activity.

For Policy, Risk & Compliance Officers

The AsyncAPI incident creates overlapping incident response, forensic, and regulatory obligations. Credential exfiltration from build environments may constitute reportable data breach depending on jurisdictions and credential type. Organizations in financial services, healthcare, and critical infrastructure sectors face sector-specific reporting obligations. The incident exposes tensions in responsibility distribution across open-source maintainers, platform providers, and consuming organizations, underscoring that supply chain security is a tripartite problem requiring coordinated response. Open-source maintainers operate under resource constraints and cannot reasonably be expected to provide specialized security expertise. GitHub, as platform provider, has not sufficiently hardened the permission model against Pwn Request attacks. Consuming organizations bear responsibility for supply chain verification and must audit repositories they depend on, including CI/CD configurations, and make informed risk decisions.

Operational Implications

Immediate (Days to Weeks): Any development environment or CI/CD pipeline that installed affected AsyncAPI npm packages during the exposure window must be treated as confirmed compromised until proven otherwise. This includes developer workstations where `npm install` was executed, automated build agents in GitHub Actions, AWS CodeBuild, Google Cloud Build, Azure Pipelines, Jenkins, GitLab CI/CD, and containerized or on-premises build infrastructure. Every credential, token, and secret accessible from affected environments must be rotated immediately: npm tokens, GitHub PATs, cloud provider access keys, internal artifact repository credentials, SSH keys, and secrets accessible from environment variables. Development machines and build agents should be isolated from network access pending forensic examination. Build agents should be decommissioned and rebuilt rather than remediated in place, given RAT persistence capabilities. Miasma RAT indicators of compromise must be immediately integrated into endpoint detection and response platforms, SIEM solutions, and network detection systems. Artifacts generated by affected build pipelines during the exposure window must be treated as potentially compromised, with rolling back to pre-compromise artifacts and rebuilding from unaffected environments necessary for high-assurance remediation.

Short-Term (Weeks to Months): Conduct retroactive log review across build infrastructure, network perimeter, and endpoints during exposure window to search for anomalous outbound connections from build agents or developer machines, identify process execution anomalies during build phases, correlate published RAT IOCs against network telemetry, and document timeline and scope of RAT command-and-control activity. Audit all GitHub Actions workflows for Pwn Request-susceptible configurations, identifying all `pull_request_target` triggers combined with elevated permissions and flagging workflows with secret or token access from external pull requests. Identify whether artifacts generated by compromised build environments were published, deployed, or distributed downstream, and determine downstream notification obligations. Implement mandatory code review and approval gates on all workflows handling secrets, publish operations, or infrastructure deployment. Enforce least-privilege token and credential scoping: npm publish tokens with package-specific publish-only access, cloud credentials scoped to specific resources and operations, GitHub tokens limited to repository-specific operations, and consideration of time-limited token issuance. Evaluate and pilot package provenance and signing solutions such as Sigstore for code signing and verification, npm provenance attestation for package publication tracking, and container image attestation.

Long-Term (Months to Years): Establish or update organizational software supply chain security policy with explicit CI/CD pipeline security controls including code review and approval gates on automated publishing workflows, least-privilege credential scoping and time-limited token issuance, SBOM maintenance and dependency verification standards, supply chain incident response and downstream notification procedures, and third-party software assessment and vendor risk management guidelines. Evaluate and implement continuous monitoring for package and dependency anomalies through runtime behavior analysis, dependency vulnerability scanning and policy enforcement, package signature verification and provenance attestation, and integration with software development lifecycle tools. Brief executive leadership and board-level risk committees on supply chain attack trends and organizational exposure, presenting AsyncAPI incident as forcing function for supply chain risk reassessment and discussing second-order consequences for product security, customer trust, and regulatory obligations. Engage with AsyncAPI project governance on long-term security assurance commitments and funding, collaborate with peer organizations on supply chain security best practices, and participate in industry working groups addressing CI/CD pipeline security and package provenance.

Recommended Actions

Actions are organized by organizational security maturity. Baseline controls apply across all tiers and should be treated as immediate priorities regardless of organizational size.

Closing Statement

The AsyncAPI supply chain compromise is a watershed moment for organizational understanding of modern threat landscapes. This incident is not an edge case; it is a demonstration of operationalized attack patterns that adversaries have already integrated into routine targeting campaigns. The Pwn Request vector is straightforward to execute, difficult to detect, and applicable to thousands of open-source and commercial repositories. The consequences—credential exfiltration combined with persistent remote access—extend far beyond the compromised package to potentially every downstream consumer, every internal system accessible from compromised build environments, and every supplier relationship involving affected software.

Organizations treating build infrastructure as lower-priority security surfaces, maintaining overly broad credential scoping in CI/CD pipelines, and lacking supply chain visibility through SBOM programs will be disproportionately affected by incidents of this type. The pathway from malicious pull request to persistent enterprise compromise is now operationalized. Remediation requires immediate tactical action—credential rotation, system isolation, artifact rebuilding—combined with strategic improvements: CI/CD pipeline hardening, software provenance programs, and formalized supply chain governance. The incident provides the forcing function necessary to align security investment with genuine risk.