Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This analysis breaks down the attack chain, payload delivery, and recommended defenses. The post Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery appeared first on Microsoft Security Blog . In this article Attack chain overview How the attac…

https://www.microsoft.com/en-us/security/blog/2026/07/15/unpacking-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery

sha256:cec126c23482e1c99161cb741d4f8d8018b1d62f9c4ed0b5e36aedf592f1ce66

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url2
ipv41
ipv67
sha10
domain17
sha25610
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	github.com	Open →
domain	package.json	Open →
domain	config.json	Open →
domain	node.exe	Open →
domain	rentry.co	Open →
sha256	34014776d3d3ff11bc4439b02fd7ac0f02a887eb3a052eeafff236e2f6db8ad1	Open →
sha256

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports