Cybersecurity Roundup: Critical Vulnerabilities, Supply Chain Attacks, and Major Breaches The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with new entries, including a KNX Association protocol flaw (Connection Authorization Option 1) and multiple Oracle, SonicWall, Microsoft, and Cisco IOS vulnerabilities. These additions highlight active exploitation risks, urging organizations to prioritize patching. In a supply chain attack, malicious actors injected malware into AsyncAPI npm packages, which collectively see 2 million weekly downloads. The compromised packages could expose developers to data theft or further compromise. Lidl disclosed a data breach affecting online shop customers in Germany, Belgium, and the Netherlands, though details on the scope and impact remain limited. Microsoft’s July 2026 Patch Tuesday set a record with 621 CVEs addressed, marking the largest security update in its history. The fixes span critical vulnerabilities across Windows, Office, and other enterprise products. The U.S. Treasury sanctioned a VPN provider and cryptor seller linked to billions in ransomware losses, targeting infrastructure used by cybercriminals to evade detection and launder payments. Japan faced multiple cyber incidents, including a malware attack on Nihon Kotsu, the country’s largest taxi operator, which temporarily suspended services. Additionally, Nichirei, a major food company, confirmed a cyberattack, though operational disruptions were not disclosed. Ernst & Young (EY) is investigating a data breach involving third-party support tickets, raising concerns over unauthorized access to sensitive client information. Two members of the Scattered Spider hacking group were sentenced for their role in a £29 million cyberattack on Transport for London (TfL), underscoring the group’s financial motivations and persistent threat to critical infrastructure. A new Russian cyber campaign was uncovered, distributing fake Webex and Zoom installers to deploy Starland RAT, a remote access trojan used for espionage and data exfiltration. Security researchers identified CrashStealer, a macOS infostealer leveraging signed apps to bypass Gatekeeper protections, and TuxBot v3, an AI-powered IoT botnet with documented flaws but potential for large-scale attacks. The EU imposed sanctions on FSB-linked hackers for cyber sabotage, targeting state-backed actors behind disruptive campaigns. A Chinese cyber espionage group was found using Claude and DeepSeek AI models to enhance malware development, including a custom PowerShell reconnaissance tool. SonicWall warned of active exploitation of two SMA 1000 zero-day vulnerabilities, while Zoom patched CVE-2026-53412, a critical account takeover flaw that could allow unauthorized access to user sessions.

AsyncAPI npm Supply Chain Attack Exposes Developers to Credential Theft On July 14, 2026, attackers executed a supply chain compromise targeting the AsyncAPI project on the npm registry, publishing five malicious package versions within a 90-minute window. The attack bypassed traditional security measures by embedding malware that activates upon module import, rather than relying on install scripts rendering the `ignore-scripts` safety setting ineffective. ### Attack Mechanics & Impact The malware, identified by Microsoft, delivered a modular runtime called Miasma, capable of persistence, remote command execution, and credential theft. While some harvesting modules were dormant in the analyzed sample, the framework included encrypted logic that could be activated later via remote updates. The compromised packages @asyncapi/specs, @asyncapi/generator, generator-components, and generator-helpers were distributed through legitimate npm publishing workflows, leveraging a misconfigured GitHub Actions workflow that exposed a privileged bot token. This allowed attackers to push poisoned commits under a valid npm identity, expanding the attack’s reach to developer laptops, CI/CD pipelines, containers, and production services. ### Credential Theft Capabilities Miasma targeted over 100 environment variables and files, including: - Source control tokens (GitHub, GitLab, npm, Node.js auth tokens) - Cloud credentials (AWS, Azure, Google Cloud) - AI platform keys (Anthropic, OpenAI) - Container & orchestration tokens (Docker, Kubernetes) - Secret management files (.npmrc, AWS credentials, kubeconfig, Vault tokens, SSH keys) When a GitHub token was detected, the malware could enumerate repositories and CI context via public APIs, mirroring tactics from prior npm-based credential theft campaigns. ### Persistence & Command Channels The attack chain involved: 1. Initial compromise via a malicious pull request exploiting a misconfigured GitHub Actions workflow. 2. Poisoned package releases published through AsyncAPI’s trusted pipeline. 3. Hidden Node process execution upon package import, fetching an encrypted second-stage payload from IPFS. 4. Installation of `sync.js` in OS-specific NodeJS directories (Windows, macOS, Linux). 5. C2 communication via 85.137.53[.]71 (ports 8080, 8081, 8091) and decentralized fallback networks. ### Indicators of Compromise (IoCs) Compromised Packages & Hashes: - `@asyncapi/[email protected]` (SHA-256: `d425e4583cc6185d41e95c45eda00550045a5d1919b9a012236a4520d009dbd7`) - `@asyncapi/[email protected]` (SHA-256: `9b2e65db653ca8575c9b10eefb9a80c6006404812c2ec212bf5675e3c690233b`) - `@asyncapi/[email protected]` (SHA-256: `bfaeb987faa6de2b5a5eb63b1233d055215b09b0349a9394f2175fd7cdf385e4`) - `@asyncapi/[email protected]` (SHA-256: `082d733db0687dcd768104972b065d4b58cb1e6043688c6c20fa3702337f36ab`) - `@asyncapi/[email protected]` (SHA-256: `34014776d3d3ff11bc4439b02fd7ac0f02a887eb3a052eeafff236e2f6db8ad1`) Second-Stage Payloads: - IPFS CIDs: `Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf` (generator-family), `QmQobZSp1wRPrpSEQ56qnyq7ecZh5Bg5k1fnjt4SUwwHb9` (specs) - Drop paths: `%LOCALAPPDATA%\NodeJS\sync.js` (Windows), `~/.local/share/NodeJS/sync.js` (Linux), `~/Library/Application Support/NodeJS/sync.js` (macOS) C2 Infrastructure: - Primary IP: `85.137.53[.]71` (ports 8080, 8081, 8091) - Publisher identity: `npm-oidc-no-reply@github[.]com` ### Mitigation Steps (For Reference) Teams were advised to: - Remove compromised versions and purge npm/Yarn caches. - Rotate all exposed secrets (cloud keys, tokens, API credentials). - Hunt for `sync.js` in NodeJS directories and detached Node processes. - Pin known-good versions, rebuild from clean lockfiles, and block malicious IPFS CIDs. - Update npm CLI and review GitHub Actions token scopes to prevent recurrence.