Hackers Abuse GitHub Actions to Backdoor AsyncAPI npm Packages With Miasma RAT

A supply-chain attack compromised AsyncAPI’s publishing automation—via a vulnerable GitHub Actions configuration—to release malicious npm package versions containing Miasma-related code that executes on module import, fetches an encrypted second-stage from IPFS, and provides remote-access capabilities; affected package versions, file names, an Ethereum contract, an IPFS CID, and related network signatures are provided as IoCs, and responders are advised to audit manifests/lockfiles, review outbound connections and repository logs, rotate credentials, and harden privileged workflows.