Supply‑Chain Attack Infects AsyncAPI npm Packages, Exposing 2.25 M Weekly Downloads to Credential‑Stealing Malware
What Happened – Five malicious versions of AsyncAPI packages were published to npm after an attacker compromised two AsyncAPI GitHub repositories and abused a mis‑configured GitHub Actions workflow. The packages, signed with legitimate SLSA attestations, delivered a multi‑stage remote‑access trojan that harvests credentials, tokens, browser data, and crypto wallets.
Why It Matters for Compliance & Audit Readiness
- This incident is a textbook supply‑chain breach that tests the effectiveness of SOC 2 Access Control (CC6.1) and the organization’s ability to prove continuous, auditable oversight of third‑party code.
- Verisq’s SOC2 Access Controls capability provides continuous provenance monitoring and immutable evidence that every published artifact follows approved CI/CD policies – the exact audit trail needed to demonstrate due diligence after a supply‑chain compromise.
Who Is Affected – Software development teams, DevOps groups, and cloud‑native SaaS providers that consume AsyncAPI npm packages across any industry (tech, finance, healthcare, etc.).
Recommended Actions
- Map the supply‑chain breach to SOC 2 CC6.1 (Access Control) and CC7.1 (System Operations) controls; document the gap and remediation plan.
- Harden CI/CD pipelines: enforce least‑privilege GitHub Actions permissions, require signed commits, and disable OIDC publishing for unverified workflows.
- Deploy continuous monitoring of third‑party package provenance and integrate alerts into your audit evidence repository.
- Conduct a rapid credential rotation for any secrets that may have been exposed.
Source: BleepingComputer
Technical Notes – The attacker leveraged a misconfigured GitHub Actions workflow (OIDC trusted‑publisher integration) to publish trojanized packages under the legitimate @asyncapi namespace. The payload consists of three stages: an obfuscated JS loader, a downloader from IPFS, and a 92 k‑line modular framework that communicates via HTTP, Nostr relays, Ethereum smart contracts, and a libp2p mesh. The malware targets secrets stored in CI/CD environments, AI developer tools, and cryptocurrency wallets.