AsyncAPI Under Attack: When 2 Million Downloads Per Week Becomes a Way to Spread Malware

Campaign Summary On July 14, 2026, attackers successfully compromised the AsyncAPI organization on npm — one of the most popular open source projects for event-driven APIs, and injected malicious code