chore(blog): miasma Supply Chain Attack Postmortem Blog#5628
Conversation
✅ Deploy Preview for asyncapi-website ready!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a security incident report documenting the AsyncAPI repository compromise, affected npm packages, response timeline, attack techniques, remediation status, indicators of compromise, and related media assets. ChangesMiasma supply-chain incident report
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@markdown/blog/miasma-supply-chain-attck.md`:
- Line 102: Update the fenced attack-flow diagram in
miasma-supply-chain-attck.md to use the text language identifier, changing its
opening fence to ```text while preserving the diagram content.
- Around line 66-68: Expand the root-cause and remediation discussion to include
.github/workflows/if-nodejs-pr-testing.yml, which also runs untrusted
pull-request code under pull_request_target. Either document equivalent
remediation for that workflow or explicitly justify excluding it from the
report, and update the systemic-failure and hardening claims accordingly.
- Line 150: Update the Malware Retrieval URI entry to defang the URL by
replacing the scheme and domain separators with IOC-safe forms such as hxxps and
[.] while preserving the full IPFS path and forensic value.
- Line 5: Clarify the credential description in the incident report by
identifying the exact token or secret source that was exfiltrated, rather than
alternating between the asyncapi-bot PAT and a GITHUB_TOKEN or repository-stored
PAT. Update all affected references, including the sections around the current
statement and the additional matching occurrences, so the report consistently
names the confirmed credential without “or” ambiguity.
- Around line 3-5: Proofread the incident narrative and apply the requested
wording corrections throughout: change every “Github” to “GitHub,” revise “that
already been closed” to “that had already been closed,” correct “popinting” to
“pointing,” and change “npm rapid registry intervention” to “npm’s rapid
registry intervention,” including the additional referenced occurrences.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9b44c915-536b-4c88-8688-5e5f2e9421e2
📒 Files selected for processing (1)
markdown/blog/miasma-supply-chain-attck.md
|
|
||
| ## PHASES OF THE ATTACK | ||
|
|
||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add a language identifier to the fenced block.
Use ```text for the attack-flow diagram to satisfy Markdown linting.
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 102-102: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@markdown/blog/miasma-supply-chain-attck.md` at line 102, Update the fenced
attack-flow diagram in miasma-supply-chain-attck.md to use the text language
identifier, changing its opening fence to ```text while preserving the diagram
content.
Source: Linters/SAST tools
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #5628 +/- ##
============================================
- Coverage 100.00% 0 -100.00%
============================================
Files 23 0 -23
Lines 976 0 -976
Branches 192 0 -192
============================================
- Hits 976 0 -976 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Florence-Njeri
changed the title
|
|
||
| ## Impact | ||
|
|
||
| * **Severity:** **Critical (CVSSv3 9.8)**. The injected Miasma RAT variant executes immediately on library load. It does not wait for a postinstall script; the exact millisecond any of the compromised libraries are imported via `require` or `import` by a downstream application, developer machine, or build server, the payload triggers. This granted the attacker immediate, silent arbitrary code execution (ACE) and persistent backdoor capabilities on victim environments. |
There was a problem hiding this comment.
There has been confusing coverage of this incident publicly.
In general, I'd avoid using terms like "Miasma RAT" and "variant" - this payload uses "miasma" as a branding term, but otherwise has minimal direct association with that family of payload.
I've been using "M-RED-TEAM" to refer to this payload, which is the more unique payload self-identifier, and avoids the confusion with Mini-Shai-Hulud x Miasma.
There was a problem hiding this comment.
Hi @rami-wiz The Github security team I am in contact with identified it as Miasma RAT, so I am not sure why there is so much conflicting information about the identity of teh attack group
There was a problem hiding this comment.
@Florence-Njeri my opinion is the confusion is intentional by the actor. By including a bunch of string references to Miasma they conflate with a totally different payload, which will cause this confusion - especially for folks not tracking these attacks closely.
While "Miasma RAT" (but unrelated to Miasma) is technically correct, I think it still causes that confusion.
GitHub security team aren't really experts on the payload side here...
Microsoft, for example, is instead using Trojan:JS/MiasmStealer.SC for their rule, but echos:
The runtime is a command framework identified as M-RED-TEAM v6.4 with campaign configuration miasma-train-p1
There was a problem hiding this comment.
I see, thank you so much for the followup. I will adjust the diction of teh report to M-Red Team
Florence-Njeri
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@markdown/blog/miasma-supply-chain-attck.md`:
- Line 90: Rewrite the sentence around “deleting tags” and “repository cleanup
tasks” to clearly state that immediate mitigation is complete but repository
cleanup, including deleting tags pointing to malicious releases, remains
incomplete. Preserve the existing information about security maintainers’
remediation work and collaboration with GitHub Security.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a8b85f0f-56dd-4599-bfcd-883bdb96aedd
📒 Files selected for processing (1)
markdown/blog/miasma-supply-chain-attck.md
thulieblack
changed the title
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@markdown/blog/miasma-supply-chain-attck.md`:
- Line 75: Correct the final timeline entry’s local-time conversion: update the
11:18 UTC value in the table to 13:18 CEST, keeping the UTC time and purge event
description unchanged and consistent with the exposure-window statement.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 8ed17f87-c6d3-4aed-bb16-ca4120d1e832
📒 Files selected for processing (3)
markdown/blog/miasma-supply-chain-attck.mdpublic/img/avatars/Florence-Njeri.webppublic/img/posts/miasma_postmortem/miasma-postmortem-banner.webp
| | Repository | Component / Asset | Target Ref / Artifact | Remediation Action Required | Current Status | | ||
| | :--- | :--- | :--- | :--- | :--- | | ||
| | `asyncapi/spec-json-schemas` | Branch Head | `master` | Force-restore branch head to last legitimate commit: `57f4e61c23` | **🔴 OUTSTANDING** (Still points to malicious `689f5b9669`) | | ||
| | `asyncapi/spec-json-schemas` | Git Tags & Releases | `v6.11.2`<br>`v6.11.2-alpha.1` | Complete deletion of GitHub Release objects and underlying git tags | **🔴 OUTSTANDING** (Releases live on GitHub) | |
There was a problem hiding this comment.
So the <br> here doesn't have their closing tag, so the Netlify workflows are failing here.
…nce-Njeri/website into miasma-supply-chain-attack
|
⚡️ Lighthouse report for the changes in this PR:
Lighthouse ran on https://deploy-preview-5628--asyncapi-website.netlify.app/ |
|
@princerajpoot20 could you please approve |
|
The pipeline is breaking for some reason. I will take a look by EOD. |
|
I have the fixed pipeline #5643. It should be good now |
|
/rtm |
|
/u |
|
|
/rtm |
github-project-automation
Bot
moved this from To Be Triaged
to Done
in Website - Kanban
5 participants
Description
This pull request implements a critical, zero-day security remediation to secure the
.github/workflows/manual-netlify-preview.ymlworkflow configuration against supply chain exploits. By isolating the build environment, it prevents unauthorized execution of untrusted fork code and completely blocks the exfiltration of privileged runner credentials.Related issue(s)
asyncapi/generator#2184
Summary by CodeRabbit
Documentation
Assets