AsyncAPI npm Packages Backdoored with Miasma Malware Framework
AsyncAPI npm Packages Backdoored with Miasma Malware Framework is a critical-severity supply chain compromise issue in @asyncapi/generator-helpers, an AI agent. Affected: @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator 3.3.1, @asyncapi/specs 6.11.2 and 6.11.2-alpha.1 (all now unpublished). It has been exploited in the wild.
Is @asyncapi/generator-helpers running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
asyncapi-npm-packages-backdoored-with-miasma-malware-framework- Severity
- critical
- Attack type
- Supply chain compromise, Credential theft, Malware
- Component
- @asyncapi/generator-helpers · AI agent
- Known exploited
- Yes
- Published
- Last verified
What is this vulnerability?
Five AsyncAPI npm releases were trojanized with the Miasma framework, which supports credential theft, AI tool poisoning, lateral movement, and worm-like propagation across npm, PyPI, and Cargo. The payload runs at module-load time, so the usual npm install --ignore-scripts mitigation does not stop it, putting any CI or developer machine that imported the packages at risk.
Affected versions
| Affected | Fixed in |
|---|---|
@asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator 3.3.1, @asyncapi/specs 6.11.2 and 6.11.2-alpha.1 (all now unpublished) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator 3.3.1, @asyncapi/specs 6.11.2 and 6.11.2-alpha.1 (all now unpublished).
How do I fix it?
Purge the affected @asyncapi versions and rotate all developer and CI credentials, noting that npm --ignore-scripts does not neutralize this load-time payload.
How do I find every machine running @asyncapi/generator-helpers?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run @asyncapi/generator-helpers and which version, then enforce a policy on it.