In a nutshell: Attackers exploited a GitHub Actions vulnerability to steal developer tokens and poison ten npm packages with modular malware.
Attackers leveraged a flaw in a GitHub Actions workflow to extract access tokens and compromise several npm packages from AsyncAPI and Jscrambler with malware. The compromise exhibits typical characteristics of supply-chain attacks, in which stolen developer credentials lead to cascading security breaches.
Ten directly compromised packages are affected: jscrambler in versions 8.14.0, 8.16.0, 8.17.0, 8.18.0, and 8.20.0, and five AsyncAPI modules (@asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator@3.3.1, @asyncapi/specs@6.11.2, and @asyncapi/specs@6.11.2-alpha.1). Additionally, dependent packages such as jscrambler-webpack-plugin 8.6.2, gulp-jscrambler 8.6.2, grunt-jscrambler 8.5.2, and jscrambler-metro-plugin 9.0.2 may be indirectly affected.
The attack vector against AsyncAPI was a known configuration vulnerability in the GitHub Actions workflow that had already been reported in April. The issue lies in the pull_request_target event, which executes code from submitted pull requests in the context of the base repository with full access to secrets. Although a fix had been available since May 17, it had not yet been merged into the main branch. On Tuesday at 05:08 UTC, an attacker opened a PR with obfuscated JavaScript hidden after approximately 1,000 bytes of whitespace. The payload aimed to read GitHub Actions runner secrets and exfiltrate them to a Pastebin URL on rentry.co.
The attackers thereby obtained a token for the asyncapi-bot service account, which had access to the entire AsyncAPI organization on GitHub. Using this, they executed malicious code commits in two repositories, which automatically triggered builds and published the compromised npm packages. The malware payload resembles the Miasma framework from previous supply-chain attacks but differs significantly from known variants.
The first-stage code downloads a modular Trojan available for Linux, Windows, and macOS. It is capable of stealing passwords, browser cookies, SSH keys, npm and GitHub tokens, AWS credentials, macOS keychain entries, and cryptocurrency wallets, and communicating with a command-and-control server.
Security researchers recommend that organizations completely rebuild all developer machines that installed a compromised package from clean images and rotate all npm tokens, source-control access, cloud credentials, CI/CD secrets, SSH keys, signing keys, and browser sessions.
Source: www.csoonline.com · Published July 15, 2026
Lumi AI News — AI-assisted curation in accordance with Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.3.