GCVE-110-OSM-2026-8544

## July 14, 2026 — GitHub Actions CI compromise Versions 6.11.2 and 6.11.2-alpha.1 were published maliciously on July 14, 2026 via a separate but concurrent compromise of the asyncapi/spec-json-schemas repository by the same attacker (GitHub user ID 148100) who compromised the asyncapi/generator monorepo. The attacker pushed malicious commits to the unprotected alpha branch, triggering automated publication via asyncapi-bot. The alpha version was published at 08:06 UTC and promoted to latest at 08:30 UTC. This was an independent repo and token compromise — rotating only generator credentials is insufficient. The same attacker simultaneously compromised @asyncapi/generator 3.3.1, @asyncapi/generator-helpers 1.1.1, and @asyncapi/generator-components 0.7.1 via the generator monorepo. All malicious versions were removed from npm by 13:15 UTC. Safe pin: 6.11.1. ## November 2025 — Shai-Hulud 2.0 Versions 6.8.2, 6.8.3, 6.9.1, and 6.10.1 were compromised as part of the Shai-Hulud 2.0 supply chain attack, alongside @asyncapi/generator (2.8.5, 2.8.6), @asyncapi/generator-helpers (0.2.1, 0.2.2), and @asyncapi/generator-components (0.3.2, 0.3.3). ## July 14, 2026 — GitHub Actions CI compromise **Execution trigger** No install hook — payload fires at `require()` time during normal generator use. **Stage 1 (inline IIFE)** Injected as a single whitespace-padded line (~1,000 spaces off-screen) in the source file. Spawns a detached node process: `spawn("node", ["-e", "<stage2_script>"], {detached: true, stdio: "ignore", windowsHide: true}).unref()` **Stage 2 (IPFS downloader)** Downloads `sync.js` (8.25 MB) from IPFS CID `QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9` to a platform-specific hidden directory, executes it detached, then calls `process.exit(0)`. - Linux: `~/.local/share/NodeJS/sync.js` - macOS: `~/Library/Application Support/NodeJS/sync.js` - Windows: `%LOCALAPPDATA%\NodeJS\sync.js` **Stage 3 (`sync.js`) — AES-256-GCM self-decrypting RAT** Hardcoded master key: `rt-vault-master-key-32b-aaaaaaaa` (HKDF-SHA256). Self-identifies as campaign `miasma-train-p1`. Credential targets: - Browser profiles: Chrome, Brave, Firefox, Edge (Login Data, Cookies, Local State) - SSH keys: `~/.ssh/id_rsa`, `~/.ssh/id_ed25519`, `~/.ssh/config` - npm token (`~/.npmrc`), GitHub CLI (`~/.config/gh/`) - AWS (`~/.aws/credentials`), Git config (`~/.gitconfig`) - macOS Keychain, crypto wallets (MetaMask, Ledger) Persistence: systemd `miasma-monitor.service` (Linux) **Network indicators** - `hxxp://85[.]137[.]53[.]71:8081` — HTTP C2/exfiltration (NL, AS43641) - `hxxp://85[.]137[.]53[.]71:8080` — alternate C2 port - `rentry[.]co/elzotebo` — credentials exfiltration dead-drop (CI stage) - `rentry[.]co/elzotebo999` — loader fetch endpoint - `wss://relay[.]damus[.]io`, `wss://relay[.]nostr[.]com/` — Nostr relay C2 - IPFS CID: `QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9` (stage 2) - IPFS CID: `Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf` (react-sdk variant) **File indicators** - Malicious commit: `3eab3ec9304aa26081358330491d3cfeb55cc245` - Stage 2 drop: `sync.js` in platform NodeJS directory (see above) - Persistence service: `miasma-monitor.service` - Obfuscator fingerprint: function `_0x2d89`, rotation constant `0x32b8b` ## November 2025 — Shai-Hulud 2.0 The Shai-Hulud 2.0 campaign is an ongoing npm software supply chain attack where threat actors compromised maintainer accounts to publish trojanized versions of legitimate npm packages. The attack's core mechanism involves a malicious script executing during the package's preinstall phase, designed to achieve persistence by registering the infected machine as a self-hosted GitHub runner. The malware steals and exfiltrates sensitive data primarily focusing on developer and CI/CD secrets, including GitHub secrets and cloud credentials for AWS, Azure, and GCP. High-profile targets affected include organizations such as Zapier and ENS Domains.