Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader

Executive Summary: Socket's Threat Research Team identified four compromised @asyncapi npm packages (published 2026-07-14) that include an obfuscated first-stage implant which spawns a detached node process to download an encrypted second-stage loader from IPFS; that loader decrypts and loads a Miasma-family tasking framework with persistent service behavior, multi-channel C2 (HTTP, IPFS, Nostr, DHT), and multiple IOCs (package names, tarball SHA-256s, IPFS CID, C2 IPs, persistence paths).