At a glance Executive Summary On July 14, 2026, five official @asyncapi npm packages were published containing obfuscated remote-code-execution loaders spanning the generator monorepo and the spec-json-schemas repository. Affected packages include @asyncapi/generator (flagship CLI), three generator workspace packages, and @asyncapi/specs, a core schema dependency used by the parser, CLI, and most ...