Upwind Investigation Reveals Coordinated Attack on Multiple Official AsyncAPI npm Packages

New York, USA, July 14th, 2026, FinanceWire

A new investigation from cloud security company Upwind has uncovered what researchers describe as a coordinated software supply chain attack involving multiple official AsyncAPI npm packages. Rather than compromising a single package, the attackers gained access to multiple repositories and publishing pipelines, highlighting a more sophisticated approach to targeting open source software distribution.

The findings suggest that software supply chain attacks are becoming increasingly organized, with threat actors focusing on the infrastructure used to build and publish trusted packages instead of individual software projects.

Beyond a Single Package Compromise

According to Upwind, the campaign extended across multiple components of the AsyncAPI ecosystem.

Researchers found evidence that attackers compromised two separate GitHub repositories and successfully accessed different release branches. The investigation also identified a second independent repository compromise, indicating that multiple publishing pipelines had been breached instead of a single release process.

The attackers abused different OpenID Connect (OIDC) publishing identities during the operation, all within a relatively short timeframe. Taken together, the activity points to a coordinated effort rather than an isolated incident.

The scope of the attack distinguishes it from many previous npm compromises, which have often centered on one malicious package or a single repository. In this case, the attackers appear to have targeted the broader software release process itself.

Attackers Changed Their Playbook

Another notable aspect of the campaign was how the malicious code executed.

Many npm supply chain attacks rely on preinstall or postinstall scripts that run while a package is being installed. Those techniques have become familiar to defenders, and many security tools are designed to monitor for suspicious behavior during installation.

Upwind found that the attackers behind this campaign used a different strategy.

Instead of executing during installation, the malicious code ran during normal package imports or through alternative execution paths. Because the behavior occurred as part of expected application execution, it became more difficult to distinguish malicious activity from legitimate software operations.

Researchers also observed multiple execution techniques throughout the campaign. Although the methods varied, the attackers repeatedly used the same infrastructure and malware patterns across different repositories and publishing pipelines, suggesting an intentional effort to evade existing detection capabilities while maintaining operational consistency.

Trusted Packages Become the Attack Vector

The compromised packages originated from official publishing channels and appeared legitimate to developers.

That creates a significant challenge for organizations that rely on standard dependency management practices. Developers could import affected packages during routine work without realizing that malicious code had entered their development environments.

The impact extends beyond developer workstations. According to Upwind, CI/CD environments that imported the compromised packages may also have been exposed, increasing the potential reach of the attack across software development pipelines.

"This wasn't just a malicious package -it was a compromise of trust," said Amiram Shachar, CEO and Co-Founder of Upwind. "Multiple official AsyncAPI packages were published with backdoored code from separate repositories and publishing pipelines, showing that attackers are increasingly targeting the software release process itself."

Steps Security Teams Should Take

Following its investigation, Upwind recommends that organizations review their software supply chains to determine whether affected package versions were introduced into development environments.

The company advises verifying the precise versions of packages currently in use rather than assuming the latest release is safe. Security teams should also pin dependencies to trusted versions and inspect dependency updates, lockfiles, and Software Bills of Materials (SBOMs) for unexpected modifications.

Organizations are also encouraged to treat developer workstations and CI/CD runners that imported the affected packages as potentially compromised. As an additional precaution, credentials that were accessible from those environments should be rotated.

A Broader Challenge for Software Security

The investigation underscores how software supply chain attacks continue to evolve alongside modern development practices.

As organizations place greater trust in automated build systems and official package repositories, attackers are increasingly looking for opportunities to compromise those trusted channels. Campaigns that target publishing infrastructure instead of individual applications can affect a much wider range of downstream users while remaining difficult to detect.

Upwind says it continues to monitor the campaign and is urging organizations to strengthen their software supply chain security practices. The findings also reinforce the growing importance of runtime visibility, allowing security teams to detect malicious behavior during application execution rather than relying solely on installation monitoring or static analysis.

The San Francisco Tribune

is an independent digital publication covering technology, business, startups, innovation, and entrepreneurship from the heart of the world's leading tech ecosystem. The publication delivers timely news, founder stories, market insights, and industry analysis, connecting readers with the companies and ideas shaping the future.

Contact

News Anchor
Jane King
San Francisco Tribune
kevin@thesanfrancisotribune.com

Disclaimer. This is a paid press release.