# AsyncAPI npm Supply Chain Attack: Malware Injected Into Popular Packages Sophisticated malware discovered in packages with 2 million weekly downloads. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-07-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/1de9da40-d962-4d23-b7d4-49ae804c7e77 ## Widespread Security Breach OX Security researchers revealed that four popular packages under the AsyncAPI npm organization were compromised with malicious code. These packages, with over 2 million weekly downloads, are widely used by developers building event-driven APIs. The attack's impact spans a significant portion of professional development environments. ## Sophisticated Multi-Stage Attack Researchers describe this as a highly complex, multi-stage supply chain attack. The malware combines information-stealing, cryptocurrency theft, and Remote Access Trojan (RAT) capabilities. With 91,973 lines of code, the malicious software mimics known campaigns to mislead analysts. ## Resilient Infrastructure and Communication Attackers utilize legitimate peer-to-peer networks like IPFS (InterPlanetary File System) for communication. IPFS serves as a fallback when primary command-and-control servers fail. BitTorrent bootstrap nodes provide additional communication channels, creating multiple redundancy paths to bypass network blocks. ## Self-Propagation Capability The malware can self-replicate by injecting itself into packages maintained by compromised developer accounts on npm, PyPI, or Cargo registries. This feature transforms a single breached account into a new distribution vector, significantly increasing the attack's spread potential. ## Evasion Techniques The malware checks for virtual machine environments, endpoint detection tools, and Russian system locales - terminating if any are detected. This standard technique prevents infection of attackers' own machines or execution in security researchers' sandboxes. ## Critical Developer Actions Developers using affected package versions must immediately revoke npm, PyPI, and Cargo tokens, rotate secrets, and audit registry changes. Monitoring for unexpected connections to BitTorrent nodes or IPFS gateways is crucial. npm v12's post-install script blocking proved ineffective as code was directly injected into main files. ## Sources covering this story - https://securityaffairs.com/195395/security/asyncapi-npm-supply-chain-attack-malware-injected-into-packages-with-2-million-weekly-downloads.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._