AsyncAPI npm packages backdoored via GitHub Actions

We've identified five trojanized @asyncapi packages published on 2026-07-14. The attacker stole an npm publish token by exploiting a pull_request_target workflow vulnerability in the AsyncAPI generator repository, then injected an obfuscated downloader into normal runtime modules across four packages. Importing any of the affected packages fetches an encrypted Node.js loader from IPFS, writes it to disk as sync.js, and starts it as a detached process.

Attackers abused GitHub Actions to publish backdoored AsyncAPI npm packages, showing how CI credentials and release automation can become the shortest path to ecosystem compromise.