Contributors: Archana Manoharan, Mohsina Farooqui, Meenakshi Babu, Philip Kanthappally
Executive Summary
In July 2026, Microsoft Threat Intelligence identified a supply chain compromise impacting the official AsyncAPI NPM organization. Attackers published multiple malicious package versions under the trusted AsyncAPI namespace, leveraging developer dependencies to distribute malware. The compromised packages deployed a multi-stage Remote Access Trojan (RAT) that established persistence, retrieved second-stage payloads hosted on IPFS gateways, and communicated with external command-and-control (C2) infrastructure.
This analysis details the attack lifecycle, technical findings, recommended remediation steps, indicators of compromise (IOCs), and production-ready Kusto Query Language (KQL) hunting queries.
Technical Details
Affected Packages
The following package versions were identified as compromised:
@asyncapi/generator@3.3.1@asyncapi/specs@6.11.2-alpha.1@asyncapi/generator-helpers@1.1.1@asyncapi/specs@6.11.2@asyncapi/generator-components@0.7.1
Attack Overview
Threat actors gained unauthorized access to the AsyncAPI release pipeline, republishing legitimate packages embedded with malicious lifecycle hooks. When developers executed routine build workflows involving version-pinned tasks, toolchains utilizing npx fetched the compromised dependency chain.
Upon package execution, an obfuscated script retrieved a secondary payload (sync.js) from an IPFS gateway. The payload was saved locally inside the user’s Node.js application data directory, launched as a detached background process, and configured for system persistence.
Attack Timeline
| Stage | Phase | Activity Details |
| 1 | Package Installation | preinstall.js triggers automatically during the NPM lifecycle. |
| 2 | Build Task Invocation | The xc schema task invokes @asyncapi/html-template@3.5.5 dynamically via npx. |
| 3 | Payload Retrieval | An obfuscated JavaScript dropper downloads sync.js from an IPFS gateway. |
| 4 | Host Persistence | sync.js is written to the local Node.js support directory and executed as a detached process. |
| 5 | C2 Communication | Outbound network connection established to 85.137.53.71:8080. |
Technical Analysis
1. During routine AsyncAPI generation workflows, npx pulled the compromised dependency, executing an obfuscated lifecycle script that fetched sync.js from IPFS.
Figure 1: Obfuscated JavaScript Dropper Containing IPFS Payload URL
2. Analysis confirmed outbound network connections to 85.137.53.71:8080 initiated by the node process running sync.js.
Figure 2: External C2 Connection
3. The second-stage payload, sync.js, was retrieved directly from an IPFS gateway and executed detached in the background to evade interactive terminal detection.
Figure 3: Obfuscated JavaScript Payload (sync.js)
4. The compromise stemmed from the xc schema build task invoking @asyncapi/html-template@3.5.5. The obfuscated lifecycle script then executed the malicious JavaScript dropper. Live host response validated active AsyncAPI references across the affected environment.
Figure 4: Full Attack Chain
5. Host telemetry identified 291 unique target attempts initiated by the malware:
Figure 5: Summarized Telemetry — Total Unique Targets Scanned
Recommended Remediation Actions
- Isolate Compromised Endpoints: Immediately disconnect affected hosts from the network to halt active C2 sessions and lateral spread.
- Eradicate Host Persistence: Inspect shell initialization profiles (such as
.zshrcor.bashrc), remove unauthorized entries, and validate system startup items. - Block Network Indicators: Block the external C2 IP (
85.137.53.71) and restrict access to the malicious IPFS CIDs and public gateways at the firewall/proxy layer. - Purge Dropped Artifacts: Locate and permanently delete all instances of
sync.jsand associated temporary build artifacts from local Node.js application support directories. - Audit Package Dependencies: Review repository configurations and build systems executing affected package versions.
- Strengthen Dependency Governance: Enforce cryptographic integrity verification, strictly use package lockfiles (
package-lock.json), and eliminate dynamic, unpinnednpxpackage retrieval in automated pipelines. - Rotate Pipeline Credentials: Invalidate and rotate all API keys, access tokens, and secrets accessible to affected CI/CD runners and developer workstations.
Indicators of Compromise (IOCs)
Network & Infrastructure:
85[.]137[.]53[.]71(Port 8080)hxxps://ipfs[.]io/ipfs/Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyfhxxps://ipfs[.]io/ipfs/QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9
File Hashes (SHA-256):
24b9ee242f21a73b55f7bb3297eafb33c60840907386b542ed79fc6b72365168b9993a8ad0518849416798cf29668256ccb96598fc4423501ccab5312812653abfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4
Threat Hunting Queries (KQL)
Detect Node.js Executing sync.js:
DeviceProcessEvents
| where FileName =~ "node.exe" or FileName =~ "node"
| where ProcessCommandLine has "sync.js"
| project Timestamp, DeviceName, AccountName, ProcessId, ProcessCommandLine, FolderPath, InitiatingProcessId, InitiatingProcessCommandLine
| sort by Timestamp asc
Detect Inbound/Outbound Connections to Known IOCs:
DeviceNetworkEvents
| where RemoteIP == "85.137.53.71" or RemoteUrl has "ipfs.io"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| sort by Timestamp descCorrelated Attack Activity Timeline:
let start = datetime(2026-07-14T09:59:00Z);
let stop = datetime(2026-07-14T13:46:30Z);
DeviceProcessEvents
| where DeviceName == "X" and Timestamp between (start .. stop)
| where ProcessCommandLine has_any ("_0x", "sync.js", "asyncapi", "postinstall", "preinstall")
| project Timestamp, EventType = "Process", Detail = ProcessCommandLine
| union (
DeviceNetworkEvents
| where DeviceName == "X" and Timestamp between (start .. stop)
| where InitiatingProcessCommandLine has "sync.js"
| project Timestamp, EventType = "Network", Detail = strcat(RemoteIP, ":", tostring(RemotePort))
)
| union (
DeviceEvents
| where DeviceName == "X" and Timestamp between (start .. stop)
| where ActionType == "UnixShellProfileModification"
| project Timestamp, EventType = "Persistence", Detail = strcat(FolderPath, FileName)
)
| union (
AlertInfo
| where Timestamp between (start .. stop)
| join kind=inner (AlertEvidence) on AlertId
| where DeviceName == "xxx"
| project Timestamp, EventType = "Alert", Detail = Title
)
| sort by Timestamp ascConclusion
The AsyncAPI supply chain incident underscores how modern threat actors exploit trusted developer dependencies and build automation to bypass traditional perimeter defenses. By hijacking package release pipelines and deploying multi-stage, decentralized payloads via IPFS, attackers can rapidly establish persistence within enterprise environments before standard signature-based defenses react. Proactive monitoring, strict dependency governance, and proactive query-based threat hunting remain essential to identifying and disrupting these sophisticated attacks early in the kill chain.
As software supply chain threats continue to evolve, standard alerting alone is insufficient to protect critical CI/CD pipelines and developer environments. CyberProof’s Threat Intelligence and Detection Engineering teams provide 24/7 proactive hunting across complex endpoint, cloud, and hybrid ecosystems to uncover hidden persistence mechanisms and zero-day dependency compromises.
Discover how to safeguard your organization against emerging supply chain threats by exploring CyberProof Advanced Threat Hunting Services.
