EUVD-2025-198638

Malicious code in @asyncapi/react-component npm...

MAL-2025-190642 Malicious code in @asyncapi/react-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9ebe88915a6eee986912a6566783764ff832588763eaa7b763710ed9f992299 The package @asyncapi/react-component was found to contain malicious code. Source: ghsa-malware...

Malicious code in @asyncapi/protobuf-schema-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 927e5dcfc89c461512068769c97bb06898751cd42cd15f50d97c4760c658269b The package @asyncapi/protobuf-schema-parser was found to contain malicious code. Source: ghsa-malware...

Malware in @asyncapi/protobuf-schema-parser

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2025-198639

Malicious code in @asyncapi/protobuf-schema-parser npm...

Malicious code in @asyncapi/avro-schema-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 563d7e586605241445ca55919018f95a81d98cbf9599eefa9c812eef9ccd7747 The package @asyncapi/avro-schema-parser was found to contain malicious code. Source: ghsa-malware...

Malware in @asyncapi/avro-schema-parser

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2025-198640

Malicious code in @asyncapi/avro-schema-parser npm...

MAL-2025-190635 Malicious code in @asyncapi/avro-schema-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 563d7e586605241445ca55919018f95a81d98cbf9599eefa9c812eef9ccd7747 The package @asyncapi/avro-schema-parser was found to contain malicious code. Source: ghsa-malware...

Malware in @asyncapi/openapi-schema-parser

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @asyncapi/parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60490138601b88d5bc5b3f5cfb5d6bf7f1c04848429e5aa48c1812ff4c8208e5 The package @asyncapi/parser was found to contain malicious code. Source: ghsa-malware 58daec6c982800e33901b1072260f4b144aa0b64db38ee45dd9219fe13a654...

Malware in @asyncapi/parser

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2025-198642

Malicious code in @asyncapi/parser npm...

MAL-2025-190640 Malicious code in @asyncapi/parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60490138601b88d5bc5b3f5cfb5d6bf7f1c04848429e5aa48c1812ff4c8208e5 The package @asyncapi/parser was found to contain malicious code. Source: ghsa-malware 58daec6c982800e33901b1072260f4b144aa0b64db38ee45dd9219fe13a654...

Malware in @asyncapi/specs

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2025-198644

Malicious code in @asyncapi/specs npm...

MAL-2025-190643 Malicious code in @asyncapi/specs (npm)

@asyncapi/specs versions 6.11.2-alpha.1 and 6.11.2 were published as part of the "Miasma RAT" software supply-chain attack campaign identifier "miasma-train-p1" that compromised several widely used @asyncapi npm packages on 2026-07-14. Unlike the whitespace-hiding technique used in the compromise...

EUVD-2021-1933

Malware in sbrugna...

CVE-2021-37694

@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream SCSt microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and al...

CVE-2023-23619 Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina

Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle the functionality themself. This issue...