AsyncAPI npm supply-chain compromise distributes Miasma malware through official packages

Attackers compromised AsyncAPI release workflows and used the project's legitimate CI/CD infrastructure to publish malicious versions of four official npm packages on July 14, 2026. The poisoned packages included @asyncapi/generator, @asyncapi/generator-helpers, @asyncapi/generator-components and @asyncapi/specs. Malicious code executed when affected packages were imported and downloaded an encrypted second-stage Miasma payload capable of establishing persistent remote access. Because @asyncapi/specs is a transitive dependency used throughout the AsyncAPI ecosystem, compromised releases could execute within developer workstations, CI/CD pipelines, container builds and production services that resolved and imported the affected versions. The incident represents a direct compromise of a legitimate software supply chain rather than simple typosquatting or publication of an unrelated malicious package.