Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

Microsoft analyzed a supply‑chain compromise in the AsyncAPI npm ecosystem where threat actors compromised packages and abused trusted CI/CD workflows to push malicious code that executes at import time. The attack chain used CI pipeline trust and repository/registry access to inject import‑time payloads into published packages, enabling widespread downstream execution when developers installed or imported the compromised packages. The blog breaks down the techniques, indicators, and recommended defenses — e.g., protect CI credentials and package accounts, enable strong auth and 2FA, review/ep