[SECURITY] Malicious versions published via compromised alpha branch - @asyncapi/specs@6.11.2 (latest) and 6.11.2-alpha.1

[LidorMachluf]

Summary

Two malicious versions of @asyncapi/specs were published to npm on 2026-07-14 via a compromised alpha branch. The current latest tag points to the malicious version. This is a second, separate compromise from the same attacker who simultaneously hit the asyncapi/generator monorepo.

The asyncapi/spec-json-schemas maintainers are victims - this is a branch write token compromise, not an insider issue.

---

Affected Versions

Package	Version	Tag	Status
@asyncapi/specs	6.11.2-alpha.1	alpha	MALICIOUS
@asyncapi/specs	6.11.2	latest	MALICIOUS - currently live

Safe version: 6.11.1 (published 2026-01-30, last clean version)

---

What Happened

The attacker (GitHub user ID 148100, login invalid-email-address) gained write access to the alpha branch and made 5 commits between 07:51-08:04 UTC under the identity "Your Name" / you@example.com (unconfigured git placeholder - not any real contributor).

The key injection commit is 61a930fca7241763e306e31abe4557221e84a76c (08:04 UTC), which modified index.js (+26 lines prepended at top of file).

The release workflow (.github/workflows/if-nodejs-release.yml) triggered automatically and asyncapi-bot published via GitHub Actions OIDC:

• 6.11.2-alpha.1 published at 08:06 UTC
• 6.11.2 promoted to latest at 08:30 UTC

---

Injected Payload

26 lines prepended to the top of index.js. Fires immediately on require('@asyncapi/specs') - no install hook needed:

import * as fs from 'fs';
import * as path from 'path';
import * as https from 'https';
import { spawn } from 'child_process';
import * as os from 'os';

async function main() {
    const child = spawn('node', ['-e', `<obfuscated_downloader>`], {
        detached: true,
        stdio: 'ignore',
        windowsHide: true
    });
    child.unref();
}
main();

The obfuscated downloader (decoded):

1. Creates a hidden persistence directory per OS:
   • Linux: ~/.local/share/NodeJS/
   • macOS: ~/Library/Application Support/NodeJS/
   • Windows: %LOCALAPPDATA%\NodeJS\
2. Downloads sync.js (8.25MB RAT) from IPFS CID Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf
3. Executes it silently detached, then calls process.exit(0)

The RAT steals: browser saved passwords and cookies, SSH keys, .npmrc, GITHUB_TOKEN, NPM_TOKEN, ~/.aws/credentials, ~/.config/gh/, macOS keychain, crypto wallets.

---

Connection to asyncapi/generator Compromise

This is the same attacker, same campaign ("Miasma"), same day. The generator monorepo (next branch) was hit at 07:10 UTC, this repo (alpha branch) was hit at 07:51 UTC. Same GitHub user ID 148100, same unconfigured git identity, same payload structure.

Full details: asyncapi/generator#2184

---

Indicators of Compromise

Type	Value
Malicious commit	61a930fca7241763e306e31abe4557221e84a76c
Branch compromised	alpha
IPFS CID	Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf
Drop file (Linux)	~/.local/share/NodeJS/sync.js
Drop file (macOS)	~/Library/Application Support/NodeJS/sync.js
Drop file (Windows)	%LOCALAPPDATA%\NodeJS\sync.js
C2 / exfil IP	85.137.53.71 (NL, AS43641)
Attacker GitHub ID	148100
GH Actions run	https://github.com/asyncapi/spec-json-schemas/actions/runs/29318133538

---

Recommended Actions

For asyncapi/spec-json-schemas maintainers (urgent)

• Rotate all GitHub tokens and secrets for this repo - the alpha branch write token is compromised (separate from the generator repo tokens)
• Audit branch protection on alpha - identify how attacker gained push access
• Force-push or delete the alpha branch to remove the malicious commits (coordinate with GitHub Security first)
• Publish @asyncapi/specs@6.11.3 (or next patch) from a clean state to supersede 6.11.2 as latest
• Request npm yank of both 6.11.2 and 6.11.2-alpha.1

For users who installed @asyncapi/specs@6.11.2 or 6.11.2-alpha.1

1. Check for and delete sync.js in the drop paths above
2. Kill any orphaned node processes from those directories
3. Rotate: npm token, GitHub token, SSH keys, AWS credentials
4. Treat browser saved passwords as compromised

---

Disclosure Timeline

Time (UTC)	Event
2026-07-14 07:51	First malicious commit on alpha branch
2026-07-14 08:04	Final payload injection commit (61a930fc)
2026-07-14 08:06	@asyncapi/specs@6.11.2-alpha.1 published
2026-07-14 08:30	@asyncapi/specs@6.11.2 published as latest
2026-07-14 ~10:00	Detected by Upwind Supply Chain scanner
2026-07-14 ~11:00	Confirmed, public disclosure

---

Reported by Lidor Machluf / Upwind Security - lidor.machluf@upwind.io
Full technical analysis available on request. Related: asyncapi/generator#2184

[github-actions]

Welcome to AsyncAPI. Thanks a lot for reporting your first issue. Please check out our contributors guide and the instructions about a basic recommended setup useful for opening a pull request.
Keep in mind there are also other channels you can use to interact with AsyncAPI community. For more details check out this issue.

[Quantum-Sicarius]

Independent detection — corroborating this report

Our supply-chain probe flagged the same two @asyncapi/specs releases (6.11.2 and 6.11.2-alpha.1) automatically, matching @LidorMachluf's analysis. We're tracking our detection here:

https://threatintel.leitwacht.eu/d/LWA-2026-6769

[marcokrikke]

Also flagged by Endor Labs on our end.

Pretty sure this was already reported to npmjs, but I have done it anyway as there was no explicit mention of it in this conversation.

[amirosein-union]

i can confirm this.
Versions 6.11.2 and 6.11.2-alpha.1 were published in a compromised state, almost certainly via maintainer-account/token takeover. The package's index.js was replaced with a malicious loader. This is a widely-used package (transitive dependency of orval and many other tools), so the exposure is broad.

Malicious behavior (verified by static analysis; payload never executed):

• On module load, index.js synchronously spawns a detached child process before crashing.
• The obfuscated loader downloads a second-stage payload over HTTPS from IPFS and writes it to a per-OS persistence directory as sync.js, then spawns it detached and exits:
  • macOS: ~/Library/Application Support/NodeJS/sync.js
  • Linux: ~/.local/share/NodeJS/sync.js
  • Windows: %LOCALAPPDATA%\NodeJS\sync.js
• The second stage (fetched from IPFS) is an ~8.2 MB AES-encrypted credential harvester (require('node:crypto'), key labels rt-file-key-material-v1 / rt-vault-master-key-32b, Bun-runtime references) consistent with the Shai-Hulud family. It reads process.env and scans for cloud/npm/git credentials.
• Note: the tampered index.js mixes ESM import with module.exports, so it throws ReferenceError: module is not defined in ES module scope — but the malicious spawn runs before that crash, so the loader fires regardless.

Requested action:
Remove/unpublish 6.11.2 and 6.11.2-alpha.1, revoke the publishing token/account used, and investigate the maintainer account for takeover. Related prior advisory: GitLab GMS-2025-717 (@asyncapi/specs, Shai-Hulud 2.0).

[marcokrikke]

Pretty sure this was already reported to npmjs, but I have done it anyway as there was no explicit mention of it in this conversation.

Vulnerable versions are now gone from npmjs, removed by the GitHub security team.

Hello,

Thanks for taking the time to let us know.

Our review of the account(s) and\or package(s) named in your report has concluded. We have determined that one or more violations of npm's Open-source Terms have occurred and have taken appropriate action in response.

Please let us know if we can help in any other way!

Regards,
GitHub Trust & Safety