AsyncAPI npm Supply Chain Attack: Multi-Stage Loader Detection and Removal

---
title: Suspicious Installation of Compromised AsyncAPI Packages
id: 8a2b3c4d-1e5f-4a6b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the installation of specific compromised versions of @asyncapi packages via npm CLI.
references:
  - https://thehackernews.com/2026/07/compromised-asyncapi-npm-packages.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
  # Note: Adapt logsource.product to linux or macos if auditing unix build agents
detection:
  selection_npm:
    Image|endswith:
      - '\npm.cmd'
      - '\npm.exe'
      - '/npm'
  selection_cli:
    CommandLine|contains:
      - '@asyncapi/generator-helpers@1.1.1'
      - '@asyncapi/generator-components@0.7.1'
      - '@asyncapi/generator@3.3.1'
      - '@asyncapi/specs@6.11.2'
      - '@asyncapi/specs@6.11.2-alpha.1'
  condition: all of selection_*
falsepositives:
  - Legitimate testing of the specific compromised version for incident response purposes
level: critical
---
title: File System Presence of Compromised AsyncAPI Packages
id: 9b3c4d5e-2f6a-5b7c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the presence of malicious package. files indicating the compromised AsyncAPI versions are installed on disk.
references:
  - https://thehackernews.com/2026/07/compromised-asyncapi-npm-packages.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.persistence
  - attack.supply_chain
logsource:
  category: file_creation
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - 'node_modules/@asyncapi/generator-helpers/package.'
      - 'node_modules/@asyncapi/generator-components/package.'
      - 'node_modules/@asyncapi/generator/package.'
      - 'node_modules/@asyncapi/specs/package.'
  selection_content:
    # Note: Content analysis requires specific telemetry (e.g., Sysmon streams or advanced EDR) not available in all logs. 
    # This section is conceptual for environments that capture file content hash on creation.
    # In practice, verify the 'version' field inside these specific files.
    TargetFilename|contains: 'package.'
  condition: selection_path
falsepositives:
  - Installation of non-malicious versions (verify specific version strings in the file)
level: high

// Hunt for npm install commands involving compromised AsyncAPI versions
DeviceProcessEvents
| where Timestamp >= datetime(2026-07-01)
| where ProcessVersionInfoOriginalFileName in ("npm.exe", "node.exe") 
   or FileName in ("npm", "node")
| extend ParsedCommandLine = parse_command_line(CommandLine, "windows")
| where CommandLine has_any("@asyncapi/generator-helpers", "@asyncapi/generator-components", "@asyncapi/generator", "@asyncapi/specs")
| where CommandLine has_any("@1.1.1", "@0.7.1", "@3.3.1", "@6.11.2")
| project Timestamp, DeviceName, AccountName, InitiatingProcessAccountName, CommandLine, FolderPath
| order by Timestamp desc

-- Hunt for compromised AsyncAPI package. files
SELECT FullPath, Mtime, Size,
       read_file(filename=FullPath + "/package.") AS Content
FROM glob(globs="*/node_modules/@asyncapi/*/package.")
WHERE -- Check if the package path matches the specific compromised packages
  FullPath =~ "generator-helpers" OR 
  FullPath =~ "generator-components" OR 
  FullPath =~ "@asyncapi/generator" OR 
  FullPath =~ "specs"
  -- Note: Further parsing of Content JSON for specific version strings required

#!/bin/bash

# Array of compromised packages and versions
# Format: "package_name:version"
COMPROMISED=(
  "@asyncapi/generator-helpers:1.1.1"
  "@asyncapi/generator-components:0.7.1"
  "@asyncapi/generator:3.3.1"
  "@asyncapi/specs:6.11.2"
  "@asyncapi/specs:6.11.2-alpha.1"
)

echo "Checking for compromised AsyncAPI packages in package-lock...."

FOUND=0

for item in "${COMPROMISED[@]}"; do
  PACKAGE="${item%%:*}"
  VERSION="${item##*:}"
  
  # Grep for the package and version in package-lock.
  if grep -q "\"$PACKAGE\"" package-lock. && grep -q "\"$VERSION\"" package-lock.; then
    echo "[!] COMPROMISED PACKAGE FOUND: $PACKAGE@$VERSION"
    FOUND=1
  fi
done

if [ $FOUND -eq 0 ]; then
  echo "[-] No compromised package versions found in package-lock.."
  echo "[!] Note: You must still verify node_modules if lock file integrity is uncertain."
else
  echo "[!] ACTION REQUIRED: Audit the project immediately and rebuild using clean dependencies."
  echo " Recommended action: npm ci or rm -rf node_modules package-lock. && npm install"
fi