AsyncAPI Supply Chain Attack Exposes Critical GitHub Actions Security Gaps

On July 14, 2026, the AsyncAPI npm ecosystem suffered a significant supply chain compromise. Attackers injected the Miasma Node.js backdoor into several widely used AsyncAPI npm packages, including `@asyncapi/generator@3.3.1` and `@asyncapi/specs@6.11.2`, which collectively account for millions of weekly downloads. The malicious code was deployed through AsyncAPI's own OIDC-based trusted-publisher workflows, making the compromised packages appear legitimate with valid SLSA provenance attestations. This "provenance-preserving compromise" meant that the CI/CD pipeline itself was authentic, but the commits and workflow context had already been subverted. The backdoor, consistent with previous Miasma campaigns, launched a detached process to pull an encrypted second stage from IPFS, offering capabilities like remote command execution, file operations, and credential theft. This incident is a stark reminder that the security of the software supply chain is only as strong as its weakest link, and increasingly, that link is shifting from external dependencies to the CI/CD pipeline itself. The use of OIDC-based trusted-publisher workflows, a mechanism designed to enhance security by eliminating long-lived credentials, was ironically exploited to distribute the malicious packages. This affects any organization or developer consuming npm packages, particularly those relying on automated dependency updates or integrating with CI/CD systems that trust SLSA attestations without deeper inspection. The attack demonstrates that even with robust security features like OIDC and SLSA in place, a compromise upstream in the workflow definition or source control can render these protections ineffective. It fundamentally challenges the assumption that a "trusted" workflow inherently produces "trustworthy" artifacts. This AsyncAPI attack is not an isolated event but rather a continuation of a broader trend of sophisticated supply chain attacks targeting trusted development tooling and package ecosystems. Throughout 2026, there has been a noticeable arc of such incidents involving groups like TeamPCP and Mini Shai-Hulud, and malware like Miasma, focusing on CI/CD-centric tools and harvesting developer credentials. Earlier in March 2026, similar compromises affected Trivy and the KICS GitHub Action. The industry has been moving towards "shift-left" security, integrating security practices earlier in the development lifecycle, and adopting standards like SLSA (Supply-chain Levels for Software Artifacts) to attest to artifact provenance. However, this incident highlights a critical gap: SLSA attestation confirms *how* an artifact was built, but not necessarily that the *inputs* to that build (code, workflow definitions) were uncompromised. The increasing reliance on automation, open-source components, and complex CI/CD pipelines, often orchestrated by tools like GitHub Actions, creates a larger attack surface that sophisticated adversaries are actively exploiting. For practitioners, this incident necessitates a shift in mindset from merely verifying artifact provenance to validating the integrity of the entire build process, including the source code and workflow definitions themselves. Organizations should implement stricter controls around changes to GitHub Actions workflows, requiring multi-party review and approval for any modifications, especially those affecting release processes. Pinning all GitHub Actions to specific commit SHAs, rather than mutable tags, becomes even more critical to prevent silent updates to malicious versions. Furthermore, enhanced monitoring and anomaly detection within CI/CD pipelines are crucial to identify unusual activity, such as unexpected changes in build times, resource consumption, or network egress from runners. While OIDC is a significant security improvement, its implementation must be coupled with robust identity and access management for the workflow itself, ensuring that only authorized and verified contexts can trigger sensitive operations. Finally, investing in tools that perform deep static and dynamic analysis of dependencies, even those with valid provenance, is essential to catch injected backdoors that activate at runtime.