# asyncapi-npm-packages-backdoored-with-miasma-malware-framework: AsyncAPI npm Packages Backdoored with Miasma Malware Framework

> AsyncAPI npm Packages Backdoored with Miasma Malware Framework is a critical-severity supply chain compromise issue in @asyncapi/generator-helpers, an AI agent. Affected: @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator 3.3.1, @asyncapi/specs 6.11.2 and 6.11.2-alpha.1 (all now unpublished). It has been exploited in the wild.

- **Canonical URL:** https://catalog.anomity.ai/vuln/asyncapi-npm-packages-backdoored-with-miasma-malware-framework
- **Aliases:** ti-052
- **Severity:** critical
- **Attack type:** Supply chain compromise, Credential theft, Malware
- **Component:** @asyncapi/generator-helpers (AI agent)
- **Exploited in the wild:** yes
- **Published:** 2026-07-15
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/asyncapi-npm-packages-backdoored-with-miasma-malware-framework

## Summary

Five AsyncAPI npm releases were trojanized with the Miasma framework, which supports credential theft, AI tool poisoning, lateral movement, and worm-like propagation across npm, PyPI, and Cargo. The payload runs at module-load time, so the usual npm install --ignore-scripts mitigation does not stop it, putting any CI or developer machine that imported the packages at risk.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator 3.3.1, @asyncapi/specs 6.11.2 and 6.11.2-alpha.1 (all now unpublished) | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator 3.3.1, @asyncapi/specs 6.11.2 and 6.11.2-alpha.1 (all now unpublished).

## How do I fix it?

Purge the affected @asyncapi versions and rotate all developer and CI credentials, noting that npm --ignore-scripts does not neutralize this load-time payload.

## How do I find every machine running @asyncapi/generator-helpers?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run @asyncapi/generator-helpers and which version, then enforce a policy on it.

## References

- article: https://thehackernews.com/2026/07/compromised-asyncapi-npm-packages.html

## Related vulnerabilities

- [mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across](https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across) — critical
- [keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json](https://catalog.anomity.ai/vuln/keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json) — critical
- [mini-shai-hulud-170-npm-pypi-packages-compromised-in-coordinated](https://catalog.anomity.ai/vuln/mini-shai-hulud-170-npm-pypi-packages-compromised-in-coordinated) — critical
- [self-propagating-npm-supply-chain-worm-targets-ai-agent-packages](https://catalog.anomity.ai/vuln/self-propagating-npm-supply-chain-worm-targets-ai-agent-packages) — critical
- [litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook](https://catalog.anomity.ai/vuln/litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook) — critical
- [symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot](https://catalog.anomity.ai/vuln/symantec-the-aoki-infostealer-now-takes-claude-codex-cursor-copilot) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=asyncapi-npm-packages-backdoored-with-miasma-malware-framework