AsyncAPI npm packages backdoored through a hijacked build pipeline

Attackers backdoored several widely used @asyncapi npm packages, together drawing around three million weekly downloads, by hijacking the project's GitHub Actions build pipeline rather than stealing a maintainer's npm token. Because the project's own release workflow published the malicious versions, they carried valid provenance signatures, which prove where a package came from but not that the code was trustworthy. The payload was hidden in normal runtime files behind trailing whitespace and ran when the module was imported, not on install, so defenses aimed at install scripts missed it. Once loaded, it fetched an encrypted second stage, stole credentials and cloud and registry tokens, and planted persistence, even in developer tool configuration files.

Check

Check whether your projects or CI pulled the affected @asyncapi versions, focusing on systems that imported the modules, not only installed them, and review developer and build environments for stolen tokens.

Affected

Developers and CI pipelines that imported the compromised @asyncapi versions; the malware steals credentials, cloud keys, and npm and GitHub tokens and adds persistence, and valid provenance signatures made them look trustworthy.

Fix

Downgrade to the clean @asyncapi versions, remove the bad ones from lockfiles, caches, and mirrors, rotate credentials reachable from affected machines from a clean system, and harden CI against untrusted pull-request triggers.