---
id: 6794
title: "M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/m-red-team-asyncapi-supply-chain-compromise-via-github-actions"
published_at: "2026-07-14T10:33:36Z"
tags: ["supply-chain", "malware", "github-actions", "npm", "ci-cd-security", "asyncapi", "pwn-request"]
phying_url: "https://phying.com/item/6794"
lang: en
---

# M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

## Summary

Four @asyncapi npm packages (5 versions) shipped after an attacker exploited a 'pwn request' in an asyncapi/generator GitHub Actions workflow to steal a bot token; the payload runs on import.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-07-14T10:33:36Z
- **Original:** https://www.wiz.io/blog/m-red-team-asyncapi-supply-chain-compromise-via-github-actions
- **Phying News:** https://phying.com/item/6794