Recently, five malicious versions of the AsyncAPI package were uncovered in a Node Package Manager (npm) supply chain attack. These versions distributed a remote access Trojan equipped with information-stealing functionalities.
The attack exploited a misconfigured GitHub Actions workflow, allowing a trojanized package to be uploaded to the @asyncapi namespace, which had garnered over 2.25 million downloads within a week.
Multiple cybersecurity companies confirmed that two AsyncAPI GitHub repositories were compromised, with malware being injected into project files on July 14th.
According to Step Security, both attacks were breaches of CI/CD pipelines rather than the result of stolen npm tokens or malicious maintainers.
The researchers indicated that attackers pushed commits using placeholder git IDs, forcing each repository’s legitimate release workflow to publish through npm’s GitHub OIDC trusted publisher integration.
This method ensured that the resulting packages had valid SLSA certificates of origin, falsely indicating they originated from authorized workflows.
The compromised AsyncAPI packages include:
Application security firm Socket notes that the first-stage implant within a published package contains an obfuscated JavaScript code that activates the downloader upon import of the infected file.
The second-stage script, containing key configuration details and the main runtime, is fetched from the IPFS peer-to-peer content network and executed as a hidden process.
Cloud and application security company Wiz states that the third-stage payload comprises a “92,000-line malware framework with a modular architecture,” establishing persistence on the infected system and communicating with a command and control (C2) server via multiple channels, such as HTTP, Nostr relays, Ethereum smart contracts, and the libp2p mesh network.
Source: Step Security
The final payload employs an artifact name and configuration file indicating the presence of the Miasma backdoor, previously observed in similar supply chain attacks. SafeDep researchers speculate whether this malware is a private parallel build by the same operator or adopted by another group after its publication.
The objective appears to be the theft of sensitive information, including credentials, authentication keys, tokens, browser data, CI/CD systems data, AI developer tools, cryptocurrency wallets, and more.
Additionally, the malware includes functionalities to download Gitleaks and HackBrowserData tools, aiding in the collection of sensitive data.
However, a report from a cybersecurity firm Aikido notes that these features do not function as intended, and the data collection tools exit before capturing any information. Nonetheless, researchers assert that manual data collection can be performed using the shell.
Ox Security highlights that the malware conducts a check for local Russian IP addresses and terminates the process if a match is found.
As of now, all five versions of the four malicious packages have been removed from npm. However, developers must remain cautious, as existing installations and lock files created during the exposure period may still harbor the malicious release.
The duration of the exposure spanned approximately 4 hours and 7 minutes, from 07:10 to 11:18 UTC on July 14th.
Recommended measures include pinning to a known good file, regenerating the lock file, removing the hidden “NodeJS/sync.js” payload, terminating all malicious processes, and rotating credentials on affected systems.
Security teams document 54% of successful attacks but only warn about 14%. The remainder slips unnoticed through the environment.
The whitepaper by Picus explains how to test your SIEM and EDR rules in breach and attack simulations to ensure threats remain undetected.
Source: www.bleepingcomputer.com