AsyncAPI npm Supply Chain Attack Delivers Miasma RAT
Date Observed: July 14, 2026Ecosystem: npm (@asyncapi organization)Targets: Developers, CI/CD runners, and build systems consuming AsyncAPI packagesAttack Type: CI/CD compromise via GitHub Actions pull_request_target -> trojanized package publishImpact: 5 malicious versions across 4 packages, ~2.9M combined weekly downloads; import-time Miasma RAT delivery Key Takeaways Introduction On July 14, 2026, an attacker published trojanized versions of […]