@asyncapi/cli (>=1.4.0 <=2.16.7) potentially affected by unknown CVE via @asyncapi/studio (=0.20.2)

@asyncapi/studio NPM version =0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on @asyncapi/studio and may be impacted: - @asyncapi/cli =1.4.0, =2.16.7 Source cves: unknown CVE Source advisory: OSV:MAL-2025-190863...

EUVD-2025-198898

Malicious code in @asyncapi/studio npm...

Malicious code in @asyncapi/studio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eabd7c33d6759f64f573e5cc75565c4669ed790fe45d77d2756d1380b79063f The package @asyncapi/studio was found to contain malicious code. Source: ghsa-malware be3f6f1fe39d5dd5c1ee3ab702e2bee67bc36c54ded865ad25eb2504919b58...

MAL-2025-190863 Malicious code in @asyncapi/studio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eabd7c33d6759f64f573e5cc75565c4669ed790fe45d77d2756d1380b79063f The package @asyncapi/studio was found to contain malicious code. Source: ghsa-malware be3f6f1fe39d5dd5c1ee3ab702e2bee67bc36c54ded865ad25eb2504919b58...