Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

On July 14, 2026, the @asyncapi npm organization was compromised in a coordinated supply chain attack affecting five package versions across four packages. The attack exploited a GitHub Actions…