AsyncAPI npm organization compromised, 2M weekly downloads affected
July 14, 2026
1 min read
A Shai-Hulud Miasma evolution supply chain attack targets AsyncAPI packages, injecting a multi-staged dropper into developer tools downloaded millions of times weekly
Breaking News: Multiple AsyncAPI npm packages compromised with a multi-staged dropper.
More details to follow.
Affected Packages
Package name
Affected versions
@asyncapi/generator
3.3.1
@asyncapi/generator-components
0.7.1
@asyncapi/generator-helpers
1.1.1
@asyncapi/specs@
6.11.2, 6.11.2-alpha.1
Tags:
Security That Moves at the Speed AI Builds
See what your AI agents decide and whether it’s safe before it runs. Connect a repo in minutes.
readers loved this