M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

In July 2026, an attacker exploited a misconfigured GitHub Actions workflow in the AsyncAPI generator repository using a 'pwn request' technique to steal a privileged Personal Access Token. The attacker published five malicious npm packages under the @asyncapi namespace, which download and execute a multi-stage payload establishing persistence and connecting to C2 infrastructure. The payload targets developer credentials, including browser data, SSH keys, and cloud tokens, and communicates via HTTP, Nostr relays, Ethereum smart contracts, and IPFS. The attack leverages infrastructure and obfuscation techniques linked to the Miasma framework but shows distinct characteristics from prior campaigns.

AI-extracted · verify before operational use