AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026) TL;DR What happened: An attacker stole a privileged GitHub personal access token from AsyncAPI's CI through a misconfigured pull_request_target workflow, then used it to publish five trojanized versions across four@asyncapi npm packages on July 14, 2026.Packages Affected: @asyncapi/generator ,@as...