Attackers published malicious versions of several AsyncAPI npm packages, putting developers and systems that installed them at risk of remote access malware and secret theft. Reports say the attacker compromised two AsyncAPI GitHub repositories on July 14 and abused misconfigured GitHub Actions release workflows plus npm trusted publishing to ship trojanized versions of @asyncapi/generator 3.3.1, @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, and @asyncapi/specs 6.11.2-alpha.1 and 6.11.2 during a roughly four-hour window.
Why it matters: This matters because a trusted developer dependency with about 2.25 million weekly downloads was used to deliver malware that can provide shell access and steal credentials, tokens, wallets, and CI/CD secrets. Organizations using these packages should identify and remove the bad versions, regenerate lock files, kill related processes, and rotate exposed credentials immediately.
Bill Toulas
2026.07.15
100% relevant
This article appears to be the first tracked item here describing the AsyncAPI package compromise itself, including the affected package versions, attack path through GitHub Actions and npm trusted publishing, and the malware payload details.
← Back to all stories