{
  "entry": {
    "kind": "vuln",
    "slug": "asyncapi-npm-packages-backdoored-with-miasma-malware-framework",
    "name": "asyncapi-npm-packages-backdoored-with-miasma-malware-framework",
    "vendor": "@asyncapi/generator-helpers",
    "description": "Five AsyncAPI npm releases were trojanized with the Miasma framework, which supports credential theft, AI tool poisoning, lateral movement, and worm-like propagation across npm, PyPI, and Cargo. The payload runs at module-load time, so the usual npm install --ignore-scripts mitigation does not stop it, putting any CI or developer machine that imported the packages at risk.",
    "website": "https://thehackernews.com/2026/07/compromised-asyncapi-npm-packages.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-07-15",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "asyncapi-npm-packages-backdoored-with-miasma-malware-framework",
      "aliases": [
        "ti-052"
      ],
      "title": "AsyncAPI npm Packages Backdoored with Miasma Malware Framework",
      "summary": "Five AsyncAPI npm releases were trojanized with the Miasma framework, which supports credential theft, AI tool poisoning, lateral movement, and worm-like propagation across npm, PyPI, and Cargo. The payload runs at module-load time, so the usual npm install --ignore-scripts mitigation does not stop it, putting any CI or developer machine that imported the packages at risk.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft",
        "Malware"
      ],
      "componentType": "agent",
      "component": {
        "name": "@asyncapi/generator-helpers",
        "vendor": null,
        "package": null,
        "ecosystem": "npm",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "@asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator 3.3.1, @asyncapi/specs 6.11.2 and 6.11.2-alpha.1 (all now unpublished)",
          "fixed": null
        }
      ],
      "exploited": true,
      "exploitPublic": false,
      "publishedAt": "2026-07-15",
      "modifiedAt": "2026-07-15",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/07/compromised-asyncapi-npm-packages.html"
        }
      ],
      "mitigation": "Purge the affected @asyncapi versions and rotate all developer and CI credentials, noting that npm --ignore-scripts does not neutralize this load-time payload.",
      "detectedByAnomity": true
    }
  }
}