MalwareBleeping Computer
9.5 — CRITICAL
AsyncAPI npm packages infected with credential-stealing malware
Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that delivered a remote access trojan with info-stealing capabilities. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A supply-chain attack compromised five malicious AsyncAPI packages published to the Node Package Manager (npm), delivering a remote access trojan with info-stealing capabilities, targeting developers and organizations using these packages.
⚙️Technical Details
Affected Systems
AsyncAPI packages on npmCI/CD pipelines
Attack Vectors
GitHub Actions workflow compromisenpm's GitHub OIDC trusted-publisher integration
💥Impact Assessment
Severity: critical
Who Is at Risk
Developers and organizations using compromised AsyncAPI packages on npm
🛡️Recommended Actions
1Pin to known-good files
2Regenerate lock files
3Remove the hidden 'NodeJS/sync.js' payload
📦Affected Products
AsyncAPI packages on npm
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.