PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

wiz.io | incident | #supply-chain | #malware | #github-actions | #npm | #ci-cd-security | #asyncapi | #pwn-request
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Four @asyncapi npm packages (5 versions) shipped after an attacker exploited a 'pwn request' in an asyncapi/generator GitHub Actions workflow to steal a bot token; the payload runs on import.
Published
Collected

Related coverage

incident · wiz.io
s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know
Wiz's initial analysis of s1ngularity: malicious Nx npm versions harvested wallets, tokens and SSH keys and abused local AI CLIs for recon; a second phase exposed 5,500+ private repositories.
incident · aikido.dev
Popular code generator for TanStack Query hit by supply chain worm
This incident coverage highlights active npm package poisoning and practical supply chain defensive lessons.
incident · aikido.dev
AsyncAPI npm packages backdoored via GitHub Actions
Attackers abused GitHub Actions to publish backdoored AsyncAPI npm packages, showing how CI credentials and release automation can become the shortest path to ecosystem compromise.
blog · wiz.io
The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave
Wiz attributes the cross-ecosystem campaign to TeamPCP: @antv npm packages, actions-cool/issues-helper GitHub Action, and a VS Code extension steal credentials and drop a GitHub-polled backdoor.
blog · wiz.io
Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised
TeamPCP hit @tanstack (react-router), @uipath, @mistralai, and guardrails-ai by poisoning a GitHub Actions cache and harvesting OIDC tokens from runner memory to publish without npm credentials.
blog · wiz.io
Six Accounts, One Actor: Inside the prt-scan Supply Chain Campaign
Wiz Research traced six waves of pull_request_target exploitation to one actor three weeks before disclosure: 500+ PRs, two npm packages hit, payloads evolving from bash to AI-generated.
Back