Compromised AsyncAPI npm packages: inside a CI supply-chain attack
On July 14, 2026, four npm packages in the @asyncapi namespace, totaling over 3 million weekly downloads, were compromised to deliver credential-stealing malware. We investigate how the attack unfolded and how to know if you're affected.
Summary from Datadog Security Labs.
Explained
The technology and terms in this story. Learn more