> TritonInfoSec News
Home / Jul 16, 2026 / Story
0
#9 The Hacker News general July 15, 2026 at 09:16 UTC

Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware

By [email protected] (The Hacker News)

AI Summary

Four packages in the @asyncapi npm namespace — including @asyncapi/[email protected] and @asyncapi/specs versions 6.11.2 and 6.11.2-alpha.1 — were compromised in a supply chain attack delivering a multi-stage botnet loader, according to joint findings from OX Security, SafeDep, Socket, and StepSecurity. The AsyncAPI toolchain is widely used in event-driven API development, making downstream exposure significant for enterprise JavaScript/Node.js environments. Developers using these packages should audit their dependency trees and rotate any secrets accessible from affected build environments.

Read full article → https://thehackernews.com/2026/07/compromised-asyn…

Relevance score: 78.0/100

# More from July 16

  1. 1
    Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-days BleepingComputer
  2. 2
    Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands The Hacker News
  3. 3
    CISA warns admins to patch actively exploited SharePoint flaws BleepingComputer
  4. 4
    Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday The Hacker News
  5. 5
    Microsoft’s Secure Boot has been broken for a decade and no one noticed until now Ars Technica Security
  6. 6
    US charges alleged operators of Russian bulletproof hosting service BleepingComputer
  7. 7
    Microsoft Patches a Record 570 Security Flaws Krebs on Security
  8. 8
    New phishing kits target Microsoft 365 accounts, evade MFA BleepingComputer
  9. 10
    23andMe reaches $18 million settlement with states for massive breach The Record