Upwind Finds Coordinated Supply Chain Campaign Compromising Multiple AsyncAPI npm Packages

Upwind has identified a coordinated supply chain campaign that compromised several AsyncAPI npm packages. The attack targeted repositories, publishing pipelines, and developer systems, undermining the assumed security of official software release processes. This investigation highlights how attackers can gain access to systems responsible for publishing software, challenging the fundamental trust developers place in automated dependency management when integrating open source components into their applications, as reported by Upwind and The Next Web.