AsyncAPI npm Supply Chain Attack Deploys Miasma RAT via Compromised GitHub Actions

AsyncAPI's npm ecosystem was compromised via vulnerable GitHub Actions workflows that allowed attackers to publish malicious releases under the project's legitimate npm namespace. The injected code delivered a Miasma-associated RAT that activated when affected modules were imported, launched a detached Node.js process, fetched an encrypted second stage from IPFS, and used an Ethereum smart contract and decentralized services for command-and-control updates, exposing developer endpoints, CI/CD runners, and build environments to credential theft and remote access.