--- title: Compromised npm Packages in the AsyncAPI Namespace... description: Three npm packages in the AsyncAPI namespace (@asyncapi/generator-helpers, @asyncapi/generator-components, @asyncapi/generator) have been compromised with a... canonical: https://daily.dev/posts/compromised-npm-packages-in-the-asyncapi-namespace-deliver-m--ufxycw7h1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Compromised npm Packages in the AsyncAPI Namespace Deliver M... | daily.dev og:description: Three npm packages in the AsyncAPI namespace (@asyncapi/generator-helpers, @asyncapi/generator-components, @asyncapi/generator) have been compromised with a... og:url: https://daily.dev/posts/compromised-npm-packages-in-the-asyncapi-namespace-deliver-m--ufxycw7h1 og:image: https://api.daily.dev/og/posts/UfxYcW7h1.png og:image:alt: Compromised npm Packages in the AsyncAPI Namespace Deliver M... og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Compromised npm Packages in the AsyncAPI Namespace Deliver M... **[Socket](https://daily.dev/sources/socketdev)** · 3 min read · 0 upvotes · 0 comments ## Summary Three npm packages in the AsyncAPI namespace (@asyncapi/generator-helpers, @asyncapi/generator-components, @asyncapi/generator) have been compromised with a multi-stage malware dropper. The first-stage payload is injected into src/utils.js, hidden behind whitespace, and executes at require() time by spawning a detached Node.js child process. That process downloads an encrypted second-stage payload called Miasma from IPFS, which persists as sync.js disguised as NodeJS. Miasma is a botnet framework capable of shell command execution, file operations, credential harvesting, evasion, persistence, and multi-protocol C2. Developers and CI environments that installed affected versions should immediately rotate npm tokens, GitHub tokens, cloud credentials, SSH keys, and CI secrets, and monitor for suspicious Node.js child processes and network connections to the identified C2 IP. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/compromised-npm-packages-in-the-asyncapi-namespace-deliver-m--ufxycw7h1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Compromised npm Packages in the AsyncAPI Namespace Deliver M...","url":"https://daily.dev/posts/compromised-npm-packages-in-the-asyncapi-namespace-deliver-m--ufxycw7h1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/compromised-npm-packages-in-the-asyncapi-namespace-deliver-m--ufxycw7h1"},"datePublished":"2026-07-14T09:10:53.137Z","dateModified":"2026-07-17T00:18:36.275Z","description":"Three npm packages in the AsyncAPI namespace (@asyncapi/generator-helpers, @asyncapi/generator-components, @asyncapi/generator) have been compromised with a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0291c82a853815886376ef843a1ee1cf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0291c82a853815886376ef843a1ee1cf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/compromised-npm-packages-in-the-asyncapi-namespace-deliver-m--ufxycw7h1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,npm","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"Compromised npm Packages in the AsyncAPI Namespace Deliver M..."}]} ```