Four AsyncAPI npm packages poisoned with credential-stealing remote access malware
Malicious releases of four AsyncAPI npm packages (generator, helpers, components, specs) on 14 July 2026 installed malware that steals browser, cloud and wallet data. Releases were removed. If you installed them, delete the dropped file and rotate credentials.
If you or your developers installed any of the listed versions on or after 14 July, delete the sync.js file in the NodeJS folder, rotate npm, GitHub, SSH, AWS and other cloud credentials, treat browser-saved passwords as stolen, and pin to the earlier safe versions.
What’s happening
On 14 July 2026 an attacker pushed a malicious commit to the AsyncAPI generator code repository, and the project's automated release process then published poisoned versions of three packages: @asyncapi/generator 3.3.1, @asyncapi/generator-helpers 1.1.1 and @asyncapi/generator-components 0.7.1. Two poisoned versions of @asyncapi/specs (6.11.2 and 6.11.2-alpha.1) followed from a second repository. SafeDep reports the affected packages together draw more than 2.9 million downloads a week. The code runs when the package is loaded, then downloads a larger payload that targets browser data, SSH keys, npm and GitHub tokens, AWS and other cloud credentials, and cryptocurrency wallets, and talks to attacker servers over several channels. Maintainers say the malicious versions were removed from npm on the day, disabled workflows, removed rogue commits and tags, and rolled out hardening across the organisation by 30 July. The earlier versions are named as safe. How the attacker got write access is unconfirmed, and the number of affected installations is not known. Reporters differ on attribution to the Miasma campaign.
- What
- Poisoned software
- Affects
- AsyncAPI npm packages (@asyncapi/generator, generator-helpers, generator-components, specs)
- Affected
- @asyncapi/generator 3.3.1
@asyncapi/generator-helpers 1.1.1
@asyncapi/generator-components 0.7.1
@asyncapi/specs 6.11.2 and 6.11.2-alpha.1 - Fixed in
- Malicious versions removed from npm; earlier versions named as safe: @asyncapi/generator 3.3.0, generator-helpers 1.1.0, generator-components 0.7.0, specs 6.11.1. No newer clean releases confirmed.
- Since
- 14 July 2026
- Closed
- 30 July 2026
Timeline
- Update
Workflow hardening was rolled out across the AsyncAPI organisation. The exact credential used and the number of affected installations remain unconfirmed.
- Update
Malicious commits and rogue tags were removed from the spec-json-schemas repository, and release automation was restricted to the master branch.
- Update
Affected workflows were disabled, pull request creation was limited to collaborators and GitHub releases were removed.
- Wider attacks
The release workflow published @asyncapi/generator 3.3.1, generator-helpers 1.1.1 and generator-components 0.7.1 from CI. @asyncapi/specs 6.11.2-alpha.1 (08:06 UTC) and 6.11.2 (08:30 UTC) followed from the separate spec-json-schemas repository.
- Made publicNo fix yet
An unsigned commit with a placeholder identity was pushed to the next branch of the asyncapi/generator repository, injecting obfuscated code into several source files.
- New fixPartly fixed
Maintainers reported the versions to npm and the malicious releases were removed by the afternoon. Earlier releases (generator 3.3.0, helpers 1.1.0, components 0.7.0, specs 6.11.1) were named as the safe versions to use.
Sources
- Malicious releases of AsyncAPI packages (generator issue 2184)AsyncAPI maintainers · 14 July 2026
- AsyncAPI Packages Compromised with Miasma RATSafeDep · 14 July 2026