AsyncAPI compromise triggers code when packages are imported

Microsoft reported a compromise involving five versions across four AsyncAPI package names in July. The affected set included a specification package used indirectly by other tooling, so exposure could reach build systems and applications that had not explicitly selected the poisoned package.

Researchers said the injected loader ran when the package was imported. That distinction matters for teams using an option that disables npm installation scripts: it does not prevent ordinary application code from executing during an import. The exposure review therefore needs to follow the resolved package version into subsequent builds and runtime use. The published report describes the identified versions and window, rather than every AsyncAPI package.