How many npm packages were compromised, and how widely were they used?
Attackers published five trojanized versions across four @asyncapi packages — generator, generator-helpers, generator-components, and specs — between 07:10 and 08:30 UTC on July 14, 2026. Per Wiz, the four packages combined for over 3 million weekly downloads, making this a wide-blast-radius compromise of AsyncAPI's tooling.
Answered in
A Misconfigured GitHub Action Backdoored Packages With 3M Weekly DownloadsA pull_request_target flaw in AsyncAPI's CI let attackers steal a token and trojan 4 npm packages — 3M+ weekly downloads — with credential-stealing code.
Read the full analysisOther questions this article answers
More development best practices questions
- How many outage reports did Claude and ChatGPT get on July 14, 2026?
- What did Anthropic's own status page say about the July 14 Claude outage?
- Did Claude have more outages after July 14?
- What did ChatGPT's status checker say was wrong?
- Is this outage pattern actually unusual for AI providers?
- What GitHub Actions vulnerability did the attacker exploit?
- What did the malicious payload actually do?
- Why wasn't this vulnerability fixed before the attack happened?
Every answer on Crashtech is written by the editor of the article it comes from — never auto-summarised. Browse all answers or the Development Best Practices beat.