Inside the AsyncAPI Supply Chain Compromise

Microsoft Threat Intelligence uncovered a supply chain compromise of the AsyncAPI NPM organization in July 2026. Attackers injected malicious versions of multiple packages under the AsyncAPI namespace, leveraging obfuscated lifecycle hooks to execute a multi-stage Remote Access Trojan during routine build processes. The initial payload retrieved secondary payloads from IPFS gateways, enabling persistence and command-and-control communications. The attack bypassed traditional security controls by abusing trusted build automation and dynamic package retrieval via npx, specifically targeting Node.js developers' CI/CD pipelines that rely on pinned package versions.

The compromise enables attackers to deploy Remote Access Trojans on developer systems during normal package installation and build workflows. This can lead to persistent unauthorized access and control over affected development environments. The use of trusted package namespaces and lifecycle hooks increases the likelihood of infection in development and CI/CD environments, potentially impacting software supply chains and downstream consumers of compromised packages.

No official patch or remediation guidance is provided in the available data. Organizations should review their use of AsyncAPI packages, especially those installed or updated around July 2026, and consider verifying package integrity through checksums or signatures where possible. Developers should monitor for unusual build behavior and network communications to suspicious IP addresses such as 85.137.53.71. Since this is a supply chain compromise, updating to clean, verified package versions once available and auditing CI/CD pipeline security are recommended. Patch status is not yet confirmed — check the vendor advisory or AsyncAPI official communications for current remediation guidance.