The AsyncAPI incident, documented in detail in June 2026, exposed how import-time supply chain attacks work at scale. An attacker submitted 37 pull requests to the AsyncAPI GitHub organisation over a 58-day window, gradually building contributor reputation before introducing malicious code into a CI/CD workflow that ran automatically on each PR. The payload exfiltrated CI/CD OIDC tokens that were used to publish trojaned package versions to the npm registry. Those packages had 2.9 million combined weekly downloads.

Miasma took a different path to similar impact: a self-propagating worm that abused OIDC token grants to spread across Red Hat’s npm package portfolio, injecting malicious publish steps that propagated the worm to sibling packages.

Both attacks share a common detection-relevant signature: malicious code that executes at npm install time rather than at application runtime. That execution happens in your CI/CD pipeline, in your developers’ local environments, and in production build processes. Here’s how to detect it.

Understanding Import-Time Execution Vectors

npm packages support postinstall scripts in their package.json that execute automatically when the package is installed. This is legitimate functionality used by packages that need to compile native bindings or download platform-specific binaries. It is also the primary vector for supply chain attacks at the import stage, because npm install runs these scripts with the permissions of the user running the install.

{
  "scripts": {
    "postinstall": "node ./scripts/setup.js"
  }
}

The malicious equivalent looks identical in package.json but the referenced script performs data exfiltration, backdoor installation, or token theft.

Python’s ecosystem has analogous risks through setup.py and pyproject.toml build hooks that execute during pip install. The Miasma campaign used postinstall mechanisms; PyPI packages in the same campaign period used custom setup hooks.

Detection 1: Unexpected Network Connections from Package Manager Processes

The clearest signal of a malicious postinstall hook is a network connection made by the package manager or a child process spawned during install, to a destination that is not a package registry or CDN.

title: Suspicious Network Connection from npm/pip Install Process
id: 3f7a9c12-8b4e-4d2f-a1c8-e6f9b3d5c7a2
status: experimental
description: |
  Detects outbound network connections from npm, pip, or child processes
  spawned during package installation to external IPs that are not known
  package registry infrastructure. Indicates potential malicious postinstall
  or setup.py execution.
references:
  - https://blog.asyncapi.io/security-incident-june-2026
author: SOC Analyst Hub
date: 2026-07-22
tags:
  - attack.t1195.001
  - attack.t1059.004
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/node'
      - '/npm'
      - '/python3'
      - '/pip3'
  filter_registries:
    DestinationHostname|endswith:
      - 'registry.npmjs.org'
      - 'registry.yarnpkg.com'
      - 'pypi.org'
      - 'files.pythonhosted.org'
      - 'cdn.npmjs.com'
  condition: selection and not filter_registries
falsepositives:
  - Packages that legitimately download binaries from CDNs during install
  - Approved internal registry mirrors
level: high

KQL equivalent (Microsoft Sentinel / Defender for Endpoint):

DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("node.exe", "npm.cmd", "python.exe", "pip.exe", "python3")
     or InitiatingProcessCommandLine contains "npm install"
     or InitiatingProcessCommandLine contains "pip install"
| where RemoteUrl !endswith "registry.npmjs.org"
  and RemoteUrl !endswith "pypi.org"
  and RemoteUrl !endswith "files.pythonhosted.org"
| where not (RemoteIPType == "Private")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort

Detection 2: OIDC Token Access During Package Operations

The AsyncAPI attack vector specifically targeted CI/CD OIDC tokens. These tokens are generated by GitHub Actions and similar CI systems to authenticate workflows to external services (npm publish, AWS, GCP). A malicious postinstall script running in a CI environment may attempt to access the token endpoint.

title: OIDC Token Endpoint Access During npm/pip Operations
id: 9c2e5f81-3a7d-4b8c-d2e4-f7a9b1c3d5e8
status: experimental
description: |
  Detects HTTP requests to GitHub Actions OIDC token endpoints
  from processes associated with package installation. Indicates
  a malicious package attempting to exfiltrate CI/CD credentials.
references:
  - https://github.com/asyncapi/asyncapi-security-incident-2026
author: SOC Analyst Hub
date: 2026-07-22
tags:
  - attack.t1552.007
  - attack.t1195.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationHostname: 'token.actions.githubusercontent.com'
  filter_expected:
    Image|endswith:
      - '/gh'
      - '/act'
  condition: selection and not filter_expected
falsepositives:
  - GitHub CLI operations that legitimately request OIDC tokens
level: critical

Detection 3: File System Writes During Package Installation Outside Expected Paths

Legitimate packages write files to the package directory (node_modules/ or the Python site-packages path). Malicious postinstall hooks may write to system paths, user home directories, or cron/scheduled task locations.

title: Unexpected File Write Outside Package Directories During Install
id: 7d4b8f23-1c9e-4a6d-b5f2-e8c3d7a9b1f4
status: experimental
description: |
  Detects file creation by npm or pip child processes outside of
  standard package installation directories. May indicate a malicious
  postinstall hook attempting to establish persistence.
author: SOC Analyst Hub
date: 2026-07-22
tags:
  - attack.t1195.001
  - attack.t1053.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/npm'
      - '/node'
      - '/pip3'
      - '/python3'
  filter_expected:
    TargetFilename|startswith:
      - '/home/'
      - '/root/'
    TargetFilename|contains:
      - 'node_modules'
      - '.npm'
      - 'site-packages'
  suspicious_paths:
    TargetFilename|startswith:
      - '/etc/cron'
      - '/etc/systemd'
      - '/usr/lib/systemd'
      - '/tmp/.hidden'
      - '/var/spool/cron'
  condition: selection and (not filter_expected or suspicious_paths)
falsepositives:
  - Packages with legitimate system integration steps requiring admin install
level: high

Detection 4: Self-Replicating Publish Behaviour (Miasma Pattern)

Miasma’s most distinctive behaviour was triggering workflow dispatch on sibling repositories after infecting a package. This manifests as GitHub API calls to trigger workflow dispatch events from within a CI/CD build.

In Defender for Endpoint or SIEM with CI/CD API logs, look for:

// GitHub API calls to trigger workflow dispatch from within a build
DeviceNetworkEvents
| where RemoteUrl has "api.github.com"
  and RemoteUrl has "/actions/workflows"
  and RemoteUrl has "/dispatches"
| where InitiatingProcessCommandLine !contains "gh workflow run"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteUrl

Or if you have GitHub audit logs in your SIEM:

GitHubAuditLogs
| where Action == "workflows.dispatched"
| where ActorType == "bot" or ActorType == "app"
| where not (Actor in (trusted_bot_list))
| summarize count() by Actor, Repository, bin(TimeGenerated, 5m)
| where count_ > 3

Preventive Controls

Detection is reactive. For supply chain attacks at the package import stage, the most effective controls are:

npm audit and lockfiles: Commit package-lock.json or yarn.lock and validate integrity hashes on every install. Unexpected hash changes indicate tampering.

Block postinstall by default: Use npm install --ignore-scripts in CI/CD pipelines. Only allow scripts for packages on an explicitly approved list. Most production dependencies do not require postinstall scripts.

Restrict CI/CD OIDC token scope: If your CI/CD generates OIDC tokens, ensure they are scoped to specific audiences and that the scope does not include npm publish permissions unless the specific workflow step requires it.

Monitor for registry publish events from CI: Audit npm publish events in your registry. Unexpected publishes from packages you maintain, especially from automated bot accounts or at unusual times, warrant immediate investigation.

The AsyncAPI and Miasma cases show the detection window for import-time attacks is short. The malicious code runs, collects credentials, and the pipeline moves on. The Sigma and KQL rules above are your best chance to catch the execution in real time rather than discovering the compromise weeks later during an unrelated investigation.