Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware
Summary: Four compromised npm packages in the @asyncapi namespace were found distributing a multi-stage botnet loader that runs when the infected module is loaded by Node.js, not at install time, and downloads an encrypted second-stage loader called "sync.js" from IPFS. StepSecurity said the attacker gained push access to the repositories and used each project's legitimate GitHub Actions release pipeline to publish packages with valid OIDC provenance attestations, and all five malicious versions have since been unpublished.
Why it matters: The trigger is an import rather than an install script, so the common npm install --ignore-scripts mitigation does not neutralize it, and the packages carried legitimate SLSA provenance attestations that prove only which workflow produced them, not that the triggering commits were legitimate. The compromise stemmed from a pull_request_target workflow in asyncapi/generator that checked out pull request code with full access to secrets, and a pull request containing the fix was still open and unmerged when the attack took place on July 14, 2026.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026