Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware
Wed Jul 15 2026
Development
Malware
Open Source
feeds.feedburner.com
Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security, SafeDep, Socket, and StepSecurity.
The affected packages are listed below -
@asyncapi/[email protected]
@asyncapi/[email protected]
@asyncapi/[email protected]
@asyncapi/specs(v6.11.2, v6.11.2-alpha.1)
"The