: Attackers exploited vulnerable GitHub Actions workflow with pull_request_target event. : Workflow automatically checks out and executes pull request code with full access to secrets. : Malicious JavaScript hidden after 1,000 bytes of whitespace in markdown file. : Payload scanned GitHub Actions runner environment for secrets. : Dead-drop URL used for secret exfiltration. : Attackers obtained asyncapi-bot service account token with organization-wide access. : Malicious code commits triggered automated builds publishing poisoned npm packages. : Modular malware framework with credential theft capabilities. : First-stage code downloads secondary trojan payload for multiple platforms. : Trojan targets passwords and cookies from browsers, SSH keys, npm/GitHub tokens, AWS credentials. : Trojan communicated with C2 server for remote commands. : C2 server for remote command execution and data exfiltration. : Remote commands to exfiltrate data and list directories. : Compromised packages: @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator@3.3.1, @asyncapi/specs@6.11.2. : Jscrambler packages compromised via leaked npm publishing credential. : Compromised packages: jscrambler@8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0 and related plugins. : Initial attack used preinstall hooks to execute malicious scripts. : Attackers pivoted to injecting malicious code directly in dist/index.js and dist/bin/jscrambler.js. : Cross-platform credential harvester targeting crypto wallets, AI coding assistants, cloud credentials, messaging apps. : Harvester targets password stores from browsers, Steam, and KDE. : CI/CD platform exploited via workflow misconfiguration. : Package registry used to distribute malicious packages. : Attack can occur via GitHub Actions exploit OR leaked npm credentials. : Requires both first-stage downloader AND second-stage trojan
The attackers exploited a GitHub Actions workflow vulnerability in AsyncAPI and used a leaked npm credential in Jscrambler to inject modular, developer-focused credential-harvesting trojans into the affected packages.