Reported by 1 outlet
AsyncAPI npm Supply Chain Compromise — CI/CD Pipeline Hack, 2.25M Weekly Downloads
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
AsyncAPI npm Supply Chain Compromise — CI/CD Pipeline Hack, 2.25M Weekly Downloads
bleepingcomputer.com · 90d ago · July 16th, 2026
Five malicious versions of AsyncAPI packages were pushed to npm via a compromised GitHub Actions workflow on July 14. The attacker exploited a misconfigured CI/CD pipeline — not stolen npm tokens — injecting trojanized code that carried a remote access trojan with credential-stealing capabilities. The affected packages (
@asyncapi/generator,@asyncapi/generator-helpers,@asyncapi/generator-components) had a combined weekly download count exceeding 2.25 million.The attacker pushed commits under a placeholder git identity and let the legitimate release workflow publish via npm's GitHub OIDC trusted-publisher integration — meaning the malicious packages carried legitimate SLSA provenance attestations. This is the second major npm supply chain compromise in three days following the Jscrambler incident (July 14 digest).
Action: Any developer who installed AsyncAPI packages between July 14-15 should treat their environment as compromised. Rotate all secrets, audit CI/CD pipelines for misconfigured branch protection on publish workflows, and verify OIDC trusted publishing configurations.