AI agents are increasingly expected to act across any of your APIs, publishing to a queue, waiting on a webhook, correlating an async response, not just…

Analyse publiée le 27 août 2026 par la CyberProof Research Team, basée sur une découverte initiale de Microsoft Threat Intelligence en juillet 2026. L'incident concerne une compromission de la chaîne d'approvisionnement logicielle ciblant l'organisation NPM officielle AsyncAPI.

Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that delivered a remote access trojan with info-stealing capabilities.

Five malicious AsyncAPI packages were published to npm in a supply-chain attack that used compromised GitHub Actions workflows to deliver a remote access trojan with data-stealing capabilities. The attack affected widely used @asyncapi packages, leveraged legitimate publishing pipelines and SLSA attestations, and targeted secrets, browser data, wallets, and CI/CD credentials. #AsyncAPI #GitHubActions #npm #Miasma

On July 14, 2026 at 07:10 UTC, three packages in the AsyncAPI generator monorepo (@asyncapi/generator@3.3.1, @asyncapi/generator-helpers@1.1.1, and @asyncapi/generator-components@0.7.1) were published to npm carrying an obfuscated dropper that fires the moment the library is loaded, not on install. The packages were published through the project's own legitimate GitHub Actions release workflow and carry valid npm OIDC provenance attestations, because the attacker didn't steal an npm token: they gained push access to the repository's next branch and let the project's real CI/CD pipeline do the publishing for them.

AsyncAPI npm packages with 2M weekly downloads were compromised, spreading malware with info-stealing, crypto-theft and RAT capabilities.

Four compromised AsyncAPI npm packages load a multi-stage botnet from IPFS after attackers abuse GitHub Actions, despite valid provenance attestations

Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity. The affected packages are listed below - @asyncapi/generator-helpers@1.1.1 @asyncapi/generator-components@0.7.1 @asyncapi/generator@3.3.1 @asyncapi/specs(v6.11.2, v6.11.2-alpha.1) "The

A commit to the asyncapi/generator GitHub repository injected obfuscated JavaScript into source files across multiple packages, and four malicious versions were then published to npm on 2026-07-14. The active incident affects high-download packages including @asyncapi/generator, @asyncapi/generator-components, @asyncapi/generator-helpers, and @asyncapi/specs, with no revert, deprecation, or maintainer advisory published yet. #asyncapi/generator #asyncapi/specs

Socket’s Threat Research Team found four compromised AsyncAPI npm packages in the @asyncapi namespace that deliver a multi-stage loader leading to the Miasma payload from IPFS. The malicious releases were published through trusted publishing via GitHub Actions, but the poisoned source commit already contained the implant and the final framework includes persistence, REST C2, and multiple fallback channels. #AsyncAPI #Miasma #GitHubActions #IPFS

A Symfony app that exposes an HTTP API can have that API documented directly from the code: tooling reads the controllers and routes and…