AsyncAPI Under Attack: When 2 Million Downloads Per Week Becomes a Way to Spread Malware
Campaign Summary
On July 14, 2026, attackers successfully compromised the AsyncAPI organization on npm — one of the most popular open source projects for event-driven APIs, and injected malicious code
