Summary
On July 14, 2026, security researchers at Wiz and Microsoft disclosed a coordinated supply chain attack against the @asyncapi npm organization — one of the most widely used open API specification frameworks in enterprise software. An attacker exploited a misconfigured GitHub Actions workflow to steal a highly privileged Personal Access Token (PAT), then used it to publish four malicious packages under the legitimate @asyncapi namespace.
The injected payload was identified as a command framework called M-RED-TEAM v6.4 — a multi-stage backdoor that establishes persistence and connects to attacker-controlled command-and-control infrastructure. Critically, the payload executes at import/require time rather than during package installation. This bypasses the commonly recommended defense of running npm install --ignore-scripts, leaving developers who followed that best practice fully exposed.
Microsoft and Wiz published joint analysis of the full attack chain. The malicious packages have since been removed from npm, but any organization that updated @asyncapi dependencies on July 14 should treat those systems as potentially compromised. The use of a CI/CD PAT as the pivot point reinforces how GitHub Actions misconfiguration has become one of the most dangerous overlooked attack surfaces in modern software supply chains.
Sources
- Wiz — M-RED-TEAM AsyncAPI Supply Chain Compromise via GitHub Actions
- Microsoft Security Blog — Unpacking AsyncAPI npm Supply Chain Compromise: Import-Time Payload Delivery
Commentary
Import-time execution is a deliberate escalation of supply chain attack technique — it bypasses the primary mitigation organizations have been told to rely on. This is not a theoretical gap; it is being actively exploited. Security teams need to shift thinking from “block install scripts” to “sandbox and monitor runtime behavior of all npm packages,” which is a substantially harder problem.
For red teamers, M-RED-TEAM v6.4 being the chosen payload name is worth noting. Any organization running Node.js in production should audit @asyncapi installs from July 13–15, review CI/CD PAT scopes immediately, and update SIEM detections to flag import-time unexpected outbound connections from Node processes.