{
  "id": 11318,
  "url": "https://www.microsoft.com/en-us/security/blog/2026/07/15/unpacking-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery",
  "title": "Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery",
  "summary": "Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This analysis breaks down the attack chain, payload delivery, and recommended ...",
  "authors": null,
  "category": "org",
  "topics": "military-security",
  "orgs": null,
  "regions": null,
  "published_at": "2026-07-15T18:37:00.000Z",
  "fetched_at": "2026-07-17T05:10:53.887Z",
  "source_slug": "gn-microsoft-com",
  "source_name": "Microsoft Responsible AI",
  "source_homepage": "https://microsoft.com/ai/responsible-ai",
  "ethics_ai_record_url": "https://ethics.ai/record/11318",
  "original_url": "https://www.microsoft.com/en-us/security/blog/2026/07/15/unpacking-asyncapi-npm-supply-chain-compromise-import-time-payload-delivery",
  "evidence_status": "source-only",
  "attribution": "via ethics.ai"
}