MalwareBleeping Computer
8.0 — CRITICAL
AsyncAPI npm packages infected with credential-stealing malware
Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that delivered a remote access trojan with info-stealing capabilities. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A supply-chain attack compromised five malicious AsyncAPI packages published to the Node Package Manager (npm), delivering a remote access trojan with info-stealing capabilities, affecting systems with installed versions of the infected packages.
⚙️Technical Details
💥Impact Assessment
Severity: High
Who Is at Risk
Developers with installed versions of the infected packages, particularly those using AsyncAPI in their projects
🛡️Recommended Actions
1Pin to known-good files
2Regenerate lock files
3Remove the hidden 'NodeJS/sync.js' payload and terminate all malicious processes
📦Affected Products
Npm Packages: @asyncapi/*Github Repositories: AsyncAPI GitHub repositories
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.