AsyncAPI npm Supply Chain Compromise: Mitigating Import-Time Malware Delivery

The open-source ecosystem is the lifeblood of modern development, but it remains a prime target for adversaries seeking scale and impact. The recent compromise of AsyncAPI packages on the npm registry represents a sophisticated escalation in supply chain tactics. By weaponizing trusted CI/CD workflows, threat actors successfully distributed malicious software capable of executing code at import time.

This is not a theoretical risk; it is an active infection vector targeting the backbone of your software factory. For defenders, the urgency is clear: developer workstations and build pipelines are now the frontline. If your organization utilizes AsyncAPI libraries, you must assume exposure until proven otherwise and initiate immediate hunting activities within your development environments.

Technical Analysis

Affected Products:

AsyncAPI packages hosted on the npm registry.

Attack Vector: This incident is a classic supply chain compromise leveraging CI/CD manipulation. Attackers gained unauthorized access to the publishing workflows of the AsyncAPI project. From this vantage point, they injected malicious artifacts into official package releases. The insidious nature of this attack lies in the delivery mechanism: "import-time" execution.

Unlike traditional malware requiring user interaction or specific runtime conditions, the payload within the compromised AsyncAPI packages is designed to execute immediately upon the library being loaded by the Node.js runtime. This occurs automatically during standard build processes or when an application initializes, often before any application-specific security logic runs.

Exploitation Status:

Confirmed Active Exploitation: Microsoft has confirmed the malicious packages were downloaded and executed in live environments.
Mechanism: The malicious code likely hooks into preinstall or postinstall npm lifecycle scripts, or obfuscated code within the main library entry points, triggering reverse shells or data exfiltration routines the moment npm install or require('asyncapi') is invoked.

Detection & Response

Given the stealthy nature of import-time attacks, detection relies heavily on identifying anomalous parent-child process relationships spawned by the Node.js runtime and auditing package integrity.

SIGMA Rules

The following rules target the anomalous process execution patterns typically associated with this type of compromise.

YAML

---
title: Suspicious Shell Spawn via Node.js or NPM
id: 8c4f2a1e-5d3b-4e9c-8a1b-2f3c4d5e6f7g
status: experimental
description: Detects Node.js or npm processes spawning shells (cmd, powershell, bash), which is common during post-exploitation in supply chain attacks.
references:
 - https://www.microsoft.com/en-us/security/blog/2026/07/15/unpacking-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery/
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.execution
 - attack.t1059.001
 - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npx.cmd'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts using node to execute shell utilities
level: high
---
title: Linux Node.js Supply Chain Execution
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects Node.js spawning suspicious shells or network tools on Linux systems, indicative of import-time malware.
references:
 - https://www.microsoft.com/en-us/security/blog/2026/07/15/unpacking-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery/
author: Security Arsenal
date: 2026/07/15
tags:
 - attack.execution
 - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/node'
      - '/npm'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/curl'
      - '/wget'
  condition: selection
falsepositives:
  - Developer build scripts
level: medium

KQL (Microsoft Sentinel / Defender)

Use these queries to hunt for suspicious child processes spawned by the Node.js runtime within your environment.

KQL — Microsoft Sentinel / Defender

// Hunt for Node.js spawning suspicious processes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("node.exe", "npm.cmd", "node")
| where FileName in ("powershell.exe", "cmd.exe", "bash", "sh", "curl", "wget")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc


// Network connections from Node.js to non-standard ports
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("node.exe", "node")
| where RemotePort !in (80, 443, 8080, 3000, 8443, 5000) // Filter common dev ports
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by Timestamp desc

Velociraptor VQL

This artifact hunts for Node processes that have spawned child shells, a strong indicator of active supply chain malware execution.

VQL — Velociraptor

-- Hunt for Node.js processes spawning shells
SELECT Parent.ProcessName AS ParentName,
       Parent.Pid AS ParentPid,
       Parent.CommandLine AS ParentCmd,
       Pid,
       ProcessName,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE Parent.ProcessName =~ 'node'
  AND (ProcessName =~ 'sh'
       OR ProcessName =~ 'bash'
       OR ProcessName =~ 'powershell'
       OR ProcessName =~ 'cmd')

Remediation Script (Bash)

Run this script on Linux build agents or developer workstations to audit installed AsyncAPI packages and identify suspicious lifecycle scripts that may serve as import-time payloads.

Bash / Shell

#!/bin/bash

# Audit npm packages for suspicious lifecycle scripts (preinstall, postinstall)
# Usage: ./audit_npm_supply_chain.sh

echo "[*] Scanning for suspicious npm lifecycle scripts..."

# Check if npm is installed
if ! command -v npm &> /dev/null; then
    echo "[-] npm is not installed. Exiting."
    exit 1
fi

# Define the project root (default to current directory)
PROJECT_ROOT=${1:-.}

echo "[*] Scanning directory: $PROJECT_ROOT"

# Find all package. files
find "$PROJECT_ROOT" -name "package." -type f | while read -r pkg; do
    DIR=$(dirname "$pkg")
    echo "[+] Checking: $DIR"

    # Check for preinstall/postinstall scripts in package.
    if grep -E '("preinstall"|"postinstall"|"install")' "$pkg" > /dev/null; then
        echo "[!] WARNING: Lifecycle scripts found in $pkg"
        grep -A 1 -E '("preinstall"|"postinstall"|"install")' "$pkg"
    fi

done

echo "[*] Listing currently installed AsyncAPI packages globally..."
npm list -g | grep asyncapi

echo "[*] Listing currently installed AsyncAPI packages in current project..."
npm list | grep asyncapi

echo "[+] Audit complete. Please review any warnings above."

Remediation

Identify Affected Versions: Immediately audit your package-lock., yarn.lock, or pnpm-lock.yaml files. Cross-reference installed versions with the official AsyncAPI security advisory.
Update and Reinstall: Update all AsyncAPI dependencies to the latest, verified clean versions. bash