AsyncAPI npm Supply Chain Attack: Detection and Remediation for Credential-Stealing RAT

---
title: Suspicious Node.js Child Process - Potential Supply Chain RAT
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Node.js spawning cmd.exe, powershell.exe, or bash, indicative of a malicious package executing a payload or RAT.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.003
  - attack.t1059.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\node.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  filter_legit_devtools:
    CommandLine|contains:
      - 'npm'
      - 'yarn'
      - 'webpack'
      - 'vite'
  condition: selection and not filter_legit_devtools
falsepositives:
  - Legitimate build scripts utilizing system shells
level: high
---
title: AsyncAPI Malicious Package Installation Attempt
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects execution of npm install command targeting specific AsyncAPI versions associated with the supply chain attack (Generic heuristic for rapid response).
references:
  - https://www.npmjs.com/package/asyncapi
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\npm.cmd'
      - '\npm.exe'
    CommandLine|contains:
      - 'install'
      - 'i '
    CommandLine|contains:
      - 'asyncapi'
  condition: selection
falsepositives:
  - Legitimate installation of AsyncAPI by developers
level: medium

// Hunt for Node.js spawning suspicious child processes (RAT behavior)
DeviceProcessEvents
| where InitiatingProcessFileName =~ "node.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh")
| extend PackageArgs = tostring(CommandLine)
| where not(PackageArgs contains "npm" or PackageArgs contains "yarn" or PackageArgs contains "node_modules")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, CommandLine
| order by Timestamp desc

-- Hunt for Node processes spawning shells (RAT behavior indicator)
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name = 'node'
  AND EXISTS(
      SELECT Pid
      FROM chain(parent=pslist(), depth=1)
      WHERE Name IN ('cmd', 'powershell', 'pwsh', 'bash', 'sh')
         AND NOT CommandLine =~ '(npm|yarn|webpack)'
  )

#!/bin/bash
# Audit and Remediation Script for AsyncAPI Supply Chain Compromise
# Run this in your project root directories

echo "[*] Scanning for AsyncAPI dependency..."

# Check if asyncapi is in package.
if grep -q '"asyncapi"' package. 2>/dev/null; then
    echo "[!] WARNING: AsyncAPI dependency found in package.."
    
    # List installed version
    INSTALLED_VERSION=$(npm list asyncapi --depth=0 2>/dev/null | grep asyncapi | awk '{print $2}' | tr -d '└─' | xargs)
    echo "[+] Currently installed version: $INSTALLED_VERSION"
    
    echo "[!] ACTION REQUIRED:"
    echo "1. Verify the installed version against the official AsyncAPI security advisory."
    echo "2. If malicious, remove the package: npm uninstall asyncapi"
    echo "3. Reinstall the clean version: npm install asyncapi@latest"
    
    # Optional: Force clean install of all dependencies to clear node_modules
    read -p "Do you want to perform a fresh 'npm ci' to ensure no remnants exist? (y/n) " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        echo "[*] Removing node_modules and package-lock...."
        rm -rf node_modules package-lock.
        echo "[*] Reinstalling dependencies..."
        npm ci
        echo "[*] Complete. Please rotate any exposed credentials immediately."
    fi
else
    echo "[+] AsyncAPI not found in this project."
fi