Round 106 Threats: AsyncAPI Supply Chain Compromise and CrashStealer Defense

The latest Security Affairs newsletter (Round 106) highlights a disturbing convergence of supply chain vulnerabilities and endpoint evasion tactics. For practitioners, the standout threats requiring immediate defensive posture adjustments are the AsyncAPI npm organization compromise and CrashStealer, a C++ infostealer targeting macOS.

With the AsyncAPI compromise affecting an ecosystem with 2 million weekly downloads, and CrashStealer actively masquerading as legitimate system utilities, the risk of data exfiltration and build pipeline poisoning is high. This analysis breaks down these specific threats and provides the detection logic necessary to hunt them in your environment.

Technical Analysis

1. AsyncAPI npm Organization Compromise

Nature of Threat: Supply Chain Attack.
Affected Platform: Node.js ecosystems (CI/CD pipelines, developer workstations).
Mechanism: Threat actors compromised the publishing tokens for the AsyncAPI organization on the npm registry. This allowed them to publish malicious versions of widely used packages.
Impact: With 2 million weekly downloads, any organization running npm install or npm update on affected projects between the compromise window and remediation likely injected malicious code into their build environment or production applications.

2. CrashStealer (macOS)

Nature of Threat: Infostealer / Trojan.
Affected Platform: macOS.
Mechanism: Written in C++, CrashStealer employs a masquerading technique, posing as a standard "crash reporter" utility. This allows it to bypass user suspicion and potentially some security controls that whitelist system-looking tools.
Objective: Theft of sensitive data, likely keychains, passwords, and browser cookies.

3. Lucide Proxy & OkoBot

Lucide Proxy: Student web proxies are being weaponized to form DDoS botnets. This highlights the risk of unauthorized proxy software on the network.
OkoBot: A sophisticated framework specifically targeting cryptocurrency users, likely focusing on clipboard hijacking or wallet file theft.

Detection & Response

The following detection rules target the specific behaviors outlined in Round 106. We focus on the immediate installation of compromised npm packages and the execution of masquerading binaries on macOS.

SIGMA Rules

YAML

---
title: Potential AsyncAPI Compromised Package Installation
id: 9a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects installation attempts of packages from the AsyncAPI npm scope during the compromise window. This indicates potential supply chain poisoning.
references:
  - https://securityaffairs.com/195620/malware/security-affairs-malware-newsletter-round-106.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\npm.cmd'
      - '\\npm.exe'
      - '\\npx.cmd'
      - '\\yarn.js'
      - '\\pnpm.js'
    CommandLine|contains:
      - 'install'
      - 'add'
      - 'update'
    CommandLine|contains:
      - '@asyncapi'
  condition: selection
falsepositives:
  - Legitimate developer activity installing AsyncAPI packages (investigate version)
level: high
---
title: macOS CrashStealer Masquerading Activity
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6e
status: experimental
description: Detects execution of binaries posing as crash reporters on macOS, excluding known Apple signed paths, indicative of CrashStealer activity.
references:
  - https://securityaffairs.com/195620/malware/security-affairs-malware-newsletter-round-106.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|contains:
      - 'CrashReporter'
      - 'crash_reporter'
      - 'CrashService'
  filter_legitimate:
    Image|contains:
      - '/System/Library/'
      - '/AppleInternal/'
      - '/Library/Application Support/CrashReporter/'
  condition: selection and not filter_legitimate
falsepositives:
  - Third-party software with legitimate crash reporting tools (verify signature)
level: medium

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for AsyncAPI package installations across endpoints and logs
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoOriginalFileName in~ ("npm.exe", "node.exe", "yarn.js")
| where ProcessCommandLine has_any ("install", "add", "i ")
| where ProcessCommandLine has "@asyncapi"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend Details = "Suspected npm package install from compromised AsyncAPI scope"
;
// Union with Syslog for Linux devs
union Syslog
| where ProcessName contains "npm"
| where SyslogMessage has "@asyncapi" and SyslogMessage has "install"

Velociraptor VQL

VQL — Velociraptor

// Hunt for package-lock. or yarn.lock files referencing AsyncAPI
LET package_files = SELECT FullPath FROM glob(globs="/Users/*/package-lock.")
  UNION SELECT FullPath FROM glob(globs="/Users/*/yarn.lock")

SELECT FullPath,
       read_file(filename=FullPath, length=10000) AS Content
FROM package_files
WHERE Content =~ "@asyncapi"

// Hunt for suspicious macOS binaries named CrashReporter
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ "Crash"
  AND Exe !~ "/System/.*"
  AND Exe !~ "/Library/Apple.*"

Remediation Script (Bash)

Bash / Shell

#!/bin/bash
# Audit AsyncAPI packages in Node environments
echo "[+] Scanning for @asyncapi dependencies in current directory..."

if [ -f "package-lock." ]; then
    echo "[+] Checking package-lock...."
    grep -i "@asyncapi" package-lock. && echo "[!] WARNING: @asyncapi package found. Verify integrity immediately."
fi

if [ -f "yarn.lock" ]; then
    echo "[+] Checking yarn.lock..."
    grep -i "@asyncapi" yarn.lock && echo "[!] WARNING: @asyncapi package found. Verify integrity immediately."
fi

echo "[+] Searching for unsigned 'Crash' binaries in common user paths (macOS)"
find /Users /tmp -name "*Crash*" -type f ! -path "*/Library/Logs/*" 2>/dev/null | while read file; do
    if codesign -dv "$file" 2>&1 | grep -q "code object is not signed"; then
        echo "[!] Unsigned crash-related binary found: $file"
    fi
done

echo "[+] Remediation Audit Complete."

Remediation

1. Supply Chain (AsyncAPI)

Immediate Action: Audit all package-lock., yarn.lock, and pnpm-lock.yaml files in your codebases for @asyncapi dependencies.
Update: Force an update to the latest verified versions of AsyncAPI packages released after the compromise was remediated by the maintainers.
Dependency Scanning: Run npm audit or SAST tools (e.g., Snyk, Dependabot) across all repositories to flag vulnerable or malicious versions.
Network Controls: Restrict outbound npm registry traffic to internal proxies or allow-list only the official npm registry IP ranges to prevent potential package typosquatting.

2. Endpoint (CrashStealer / macOS)

Identify and Quarantine: Use the VQL and Sigma rules above to identify macOS devices executing non-Apple binaries posing as crash reporters.
Artifact Removal: If CrashStealer is confirmed, wipe the device or restore from a pre-infection backup. Infostealers often bury persistence deep in user LaunchAgents.
Policy: Enforce code-signing policies on macOS devices to prevent the execution of unsigned binaries.

3. Network (Lucide Proxy)

Proxy Detection: Implement network monitoring to detect traffic patterns indicative of unauthorized proxy services (e.g., high-volume non-standard HTTP/S traffic from student or BYOD segments).
Blocking: Update web proxy blacklists to include known C2 domains associated with Lucide Proxy and OkoBot.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub