AsyncAPI npm packages infected with credential-stealing malware

Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that ...
CSO Online

NPM ecosystem hit with two new supply chain compromises

Stolen and leaked credentials lead to Node.js packages from AsyncAPI and Jscrambler Code Integrity being poisoned with ...
Tech Times

Meta’s Astryx Returns to GitHub Trending: JSON Manifest Stops AI Agents From Hallucinating UI Props

Meta Astryx design system is back on GitHub Trending, with a JSON manifest CLI that gives AI coding agents a machine-readable ...
Microsoft

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This ...
The Next Web

Upwind links compromise of multiple AsyncAPI npm packages to coordinated attack on software release process

Upwind traces multiple compromised AsyncAPI npm packages to a coordinated supply chain attack targeting software release pipelines and publishing identities.
Microsoft

ACR Stealer: Two observed intrusion chains amid increased threat activity

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer ...
InfoQ

Google's Genkit Ships Agents API with Detached Turns and Human-in-the-Loop for TypeScript and Go

Google released the Genkit Agents API in preview for TypeScript and Go. The open-source framework packages message history, ...