Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery
Malware Families
Excerpt
In this article Attack chain overview How the attack started: GitHub Actions pwn request Mitigation and protection guidance Learn more On July 14, 2026, Microsoft Threat Intelligence identified a coordinated supply chain compromise of the @asyncapi npm organization, a widely used set of packages for the AsyncAPI specification and code generation. Five package versions across four package names were republished within roughly ninety minutes, each carrying the same maliciously…
Read the original report →Diamond Model
Adversary
Infrastructure(3)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 24b9ee242f21a73b55f7bb3297eafb33c60840907386b542ed79fc6b72365168 | Medium | Score 53/100 | First seen |
| SHA256 | 34014776d3d3ff11bc4439b02fd7ac0f02a887eb3a052eeafff236e2f6db8ad1 | Medium | Score 53/100 | First seen |
| URL | https://ipfs.io/ipfs/Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf | High | Score 58/100 | First seen |
| SHA256 | bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4 | Low | Score 35/100 | First seen |
| SHA256 | b9993a8ad0518849416798cf29668256ccb96598fc4423501ccab5312812653a | Medium | Score 43/100 | First seen |
| SHA256 | 082d733db0687dcd768104972b065d4b58cb1e6043688c6c20fa3702337f36ab | Medium | Score 53/100 | First seen |
| SHA256 | d425e4583cc6185d41e95c45eda00550045a5d1919b9a012236a4520d009dbd7 | Medium | Score 43/100 | First seen |
| SHA256 | b270bdf8e2274ea1af0a6eed74d8f10e5fe61012d6cc226a43cc7cc7fd9f6292 | Medium | Score 43/100 | First seen |
| SHA256 | 8351d251cf0b5a0bd82242deaa0a14e3e1394418d55c0f4259dac4303b79fc0c | Medium | Score 53/100 | First seen |
| URL | https://ipfs.io/ipfs/'; | High | Score 58/100 | First seen |
| SHA256 | 6e78713b75bd34828d49896176627f7face7aa9036cd874f2e02d9f23a9a9c71 | Medium | Score 53/100 | First seen |
| SHA256 | 9b2e65db653ca8575c9b10eefb9a80c6006404812c2ec212bf5675e3c690233b | Medium | Score 53/100 | First seen |
| IP | 85.137.53.71 | High | Score 64/100 | First seen |
IOC Relationship Graph
Building graph…