Multiple @asyncapi npm packages were compromised and published with embedded malicious code (a variant of the "Miasma" malware, build label "miasma-train-p1"). Trojanized versions of @asyncapi/specs (6.11.2 and 6.11.2-alpha.1), @asyncapi/generator (3.3.1), @asyncapi/generator-helpers (1.1.1), and @asyncapi/generator-components (0.7.1) were published to the npm registry on 2026-07-14. Unlike typical supply-chain attacks that abuse install-time lifecycle hooks, the malware is injected directly into runtime modules and executes on a simple require() of the package. The obfuscated downloader spawns a detached Node process that fetches an encrypted loader from IPFS, decrypts it via HKDF-SHA256/AES-256-GCM, and establishes a persistent implant providing remote shell access and beaconing to an HTTP command-and-control server (~30s intervals) using secp256k1 ECDH + AES-GCM, with Nostr/Ethereum update channels. The malware includes (disabled in this build) credential-harvesting capabilities targeting cloud providers, SSH keys, browsers, CI/CD systems, and crypto wallets, as well as package-manager self-propagation (npm, PyPI, Cargo). Any application that installs and loads an affected version is fully compromised, allowing arbitrary remote code execution on the host.