AsyncAPI npm supply-chain compromise via GitHub Actions (M-RED-TEAM)

The prior weekly tracked the npm supply-chain wave through the jscrambler and injectivelabs compromises, whose signature was moving the dropper out of the install hook to evade scanners. This week the wave's front edge moved again — from poisoning packages to abusing the trust machinery around them, and the developer is now squarely the target. The marquee event was AsyncAPI: the attacker rode the org's own legitimate CI/CD release workflow, so the trojanized versions carried cryptographically valid npm/OIDC provenance attestations and executed at import time "even though the triggering commits were unauthorized," defeating --ignore-scripts (Microsoft, 2026-07-15) — the detailed provenance-vs-authorization lesson is in this week's incidents recap. In parallel, the DPRK-aligned Contagious Interview campaign broadened the developer-targeting vector beyond the registry entirely: Elastic documented a fake job posting delivering a trojanized Next.js repo that hides its payload as Base64 fragments inside HTML comments across every SVG flag image in an assets directory, reassembled alphabetically and run with eval() to evade scanners that do not parse SVG comment bodies, then running an OtterCookie-aligned credential/wallet stealer on project startup (Elastic, 2026-07-18). The consolidated status: the wave the pipeline tracks now spans package poisoning, CI/CD-pipeline compromise and job-interview repos, and its through-line is that the developer's build environment and the trust signals around it (attestations, install hooks, static scanners) are the surface — so branch-protection and workflow-trigger review, import-time dependency monitoring, and treating any candidate/contractor take-home repo as untrusted code are the current counters.

The npm / developer-ecosystem supply-chain wave this pipeline has tracked across prior weeklies added a distinct front this week, and the delta is the target layer.

Earlier stages of the wave moved from poisoning published packages with evasive install hooks (jscrambler, injectivelabs) to abusing the trust machinery around packages — the AsyncAPI compromise rode the org's own legitimate CI/CD release workflow so its trojanized versions carried cryptographically valid provenance attestations, and the DPRK-aligned Contagious Interview campaign targeted developers directly through fake job repos. This week's addition, CrowdStrike's SANDWORM_MODE, moves one layer further in: instead of poisoning a package or a pipeline, the multi-stage npm worm writes rogue Model Context Protocol (MCP) tool-provider entries into AI coding-assistant configurations — Cursor, VS Code, Claude Desktop and Windsurf — so the assistant itself loads and trusts an attacker-controlled tool provider, injects global git-template hooks for persistence, and exfiltrates npm, AWS and SSH credentials alongside multi-provider LLM API keys, delaying activation 48-96 hours on workstations to break the correlation between install time and malicious behaviour (CrowdStrike, 2026-07-21).

The prior weekly tracked this wave's front edge moving into the AI coding assistant's own trust configuration. This week the wave gained something it had lacked — independent cross-vendor agreement on who is running a significant part of it, and a named CI mechanism defenders can go and check.

Amazon published an attribution assessment covering three of the ecosystem's most consequential compromises, stating that "based on analysis of command-and-control (C2) indicators and TTPs, Amazon Threat Intelligence assesses with medium confidence that these campaigns are attributable to the DPRK-linked threat actor tracked as SAPPHIRE SLEET" — a cluster it also names as STARDUST CHOLLIMA, BlueNoroff, CageyChameleon and Alluring Pisces (AWS Security Blog, 2026-07-29). The access mechanism is consistent and is not a platform weakness: "in each case, the threat actor gained access by socially engineering a trusted maintainer of the package, then published a software update containing malicious code." (AWS Security Blog, 2026-07-29). Amazon also assesses that a small March 2025 compromise served as a testing ground for the more visible operations that followed (AWS Security Blog, 2026-07-29), and identifies an evasion design that has direct implications for how organisations scan: the payload "is designed to defeat scanners that evaluate packages one by one instead of reasoning about how they interact in a real dependency graph" (AWS Security Blog, 2026-07-29).

Google's threat-intelligence group published defender-facing guidance a day later and reached the same attribution independently, attributing the activity to an actor it now calls MIDNIGHT NEPTUNE, formerly known as UNC1069 (Google Cloud Blog, 2026-07-30). Neither vendor states the equivalence itself; the reporting on Amazon's briefing does, recording that "security researchers track the group under several names, including UNC1069, Sapphire Sleet and Stardust Chollima" (CyberScoop, 2026-07-29) — which is what makes this two vendors looking rather than one vendor being repeated. Its own assessment of the trend is unhedged on direction: "GTIG assesses with high confidence that the growth in very large-scale, open-source supply chain compromise campaigns, including use of worms and iterative compromises in 2025 and early 2026, represent a significant expansion in use of this tactic compared to prior years." (Google Cloud Blog, 2026-07-30).

The most immediately actionable content is a named CI mechanism belonging to a different cluster: "UNC6780 (aka \"TeamPCP\") conducted extensive open source supply chain compromises targeting ecosystems like PyPI, npm, and Docker Hub. Initial infection vectors varied across incidents, and included abuse of the pull_request_target GitHub Actions trigger to obtain base repository secrets and write permissions." (Google Cloud Blog, 2026-07-30). That trigger is worth singling out because it is not a misconfiguration in the usual sense — pull_request_target runs workflow code in the context of the base repository, with its secrets, deliberately, so a workflow that checks out or executes anything from the incoming fork hands those secrets to whoever opened the pull request. It is a design that behaves exactly as documented and is very easy to use wrongly.

The wave prior weeklies tracked from install-hook evasion, through abuse of the trust machinery around packages, to poisoned AI coding-assistant tool configurations produced its largest single event this week. Two things changed at week level that the day-by-day entries do not carry.

The first is that what looked like two events is one. The compromise of the keyv and cacheable npm namespaces, reported on 4 August by Socket and independently by several other vendors within roughly 48 hours, is the same wave this pipeline covered as CHAINDROP two days later: Socket traces it to a compromised maintainer account whose packages "were published with a malicious preinstall hook (setup.mjs) that downloads a standalone Bun runtime, executes an obfuscated second stage, harvests cloud and CI credentials, and republishes trojanized versions of other packages the stolen npm token can reach" (Socket Threat Research, 2026-08-04), the same mechanics Elastic and Unit 42 later detailed under the CHAINDROP name. The reach matters because of where these packages sit: keyv resolves as a transitive dependency beneath common tooling rather than as something teams install deliberately, so most affected estates never chose it.

The second delta is an operational order that inverts the standard reflex, and it is the reason this status entry exists rather than a line in the roll-up. Socket documents a host-level dead-man's switch installed alongside the credential theft — a watcher registered as a launch agent on macOS and as a lingering user-level service on Linux, polling the GitHub API with the stolen token roughly once a minute. Its instruction to responders is explicit: "Before rotating any credential, hunt for and remove the host-level dead-man's switch. Revocation is its trigger: the watcher runs eval on a remote-supplied handler the moment the stolen token returns an HTTP 4xx." Every incident-response playbook opens with credential rotation; on this campaign that step executes attacker code on the host. The corollary for anyone who has already rotated is that the switch has already fired, and the host needs treating accordingly.

Alongside that, the cross-vendor convergence hardened the strategic conclusion the operational entries reached from the other direction. Unit 42's analysis found a path that trades a runner OIDC token at npm's trusted-publishing endpoint for a real publish credential and then signs the result through the public transparency infrastructure, producing provenance it is explicit is not forged (Unit 42, 2026-08-06). Socket states the general form: "provenance attests build integrity, not source integrity. The npm and sigstore pipeline did exactly what it is designed to do and still produced a signed, verifiable attestation for malware, because the source it built from was already trojanized." An organisation that added provenance verification to its dependency policy in the past year — a reasonable thing to have done — has a control that would have passed this package.

Triage: the credential-harvesting stage runs at install time from a package manager's process tree, which is the discriminator against ordinary developer activity — build scripts legitimately spawn interpreters, but a package install that downloads and executes a fresh language runtime is not a normal build step. For the persistence, the artefacts Socket names are a user-scoped launch agent and a lingering user-level service whose job is to make an HTTP request on a timer; a periodic outbound API call from a user-level service on a developer laptop is unremarkable in isolation, and is the signal when it appeared in the same window as a package installation.

Microsoft Threat Intelligence published a forensic timeline of the AsyncAPI npm compromise that adds a detail with broad supply-chain-defence implications (Microsoft Threat Intelligence, 2026-07-15). Once the attacker held push access as the AsyncAPI service account (via the pull_request_target misconfiguration covered in the original entry), no npm-token theft was needed: a direct push to a release-triggering branch ran the project's own legitimate release-with-changesets workflow, which published the packages via npm trusted publishing over GitHub OIDC. As a result the five trojanized versions carry cryptographically valid provenance attestations that correctly identify the real repository, commit and workflow — even though the triggering commit was unauthorized (Microsoft Threat Intelligence, 2026-07-15).

Two further deltas: the payload triggers at import time (embedded in one file per package — index.js for the specs package, validator.js/utils.js/ErrorHandling.js for the generator family) and unwraps an IPFS-fetched bundle through three static-key crypto layers to an eval(), so npm install --ignore-scripts provides no protection; and Microsoft recovered all three self-identifying strings — M-RED-TEAM v6.4, miasma-train-p1 and miasma-test-org — from one binary, resolving the identifier ambiguity across the original reporting. Unit 42 independently corroborates the timeline and identifies the payload as a descendant of the same Miasma RAT deployed in the June 2026 Red Hat supply-chain operation (Unit 42, 2026-07-15).