Four compromised AsyncAPI npm packages load a multi-stage botnet from IPFS after attackers abuse GitHub Actions, despite valid provenance attestations
Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity.
The affected packages are listed below -
@asyncapi/generator-helpers@1.1.1
@asyncapi/generator-components@0.7.1
@asyncapi/generator@3.3.1
Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that…
Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that…
4 malicious npm packages with 3,006 downloads spread stealers and Phantom Bot, forcing removals and secret rotation.
Upwind traces multiple compromised AsyncAPI npm packages to a coordinated supply chain attack targeting software release…
A self-replicating worm that hijacks GitHub Actions pipelines to publish malicious npm packages has struck again, compromising…
Popular JavaScript modules including size-sensor and echarts-for-react hit as hijacked account closed GitHub warnings
