The dangerous moment is no longer package install. These poisoned AsyncAPI packages execute as soon as Node imports them, so a CI job, container build, or production service can be infected just by resolving a dependency that never ran an install script.
Microsoft says five republished versions are affected: @asyncapi/specs@6.11.2 and @asyncapi/specs@6.11.2-alpha.1, @asyncapi/generator@3.3.1, @asyncapi/generator-components@0.7.1, and @asyncapi/generator-helpers@1.1.1. The loader drops a second stage from IPFS and now resolves to a Miasma runtime with active C2 and persistence, which broadens the blast radius across developer workstations, CI/CD pipelines, container builds, and any runtime that imports these packages.
The standard `--ignore-scripts` defense does not help here because the trigger is module load, not an install hook. That makes any environment that imported the packages during the exposure window a live compromise candidate, even if it never executed npm scripts.