For years, software supply chain attacks have often been associated with individual malicious packages that slipped into public repositories. Security teams responded by strengthening controls around package installation, dependency management, and vulnerability scanning. But as defenders improved those safeguards, attackers began changing their tactics.
New research from Upwind suggests that the software release process itself is becoming the next target.
The cloud security company has disclosed findings from an investigation into a coordinated attack involving multiple official AsyncAPI npm packages. Rather than exploiting a single repository or package, the attackers compromised multiple repositories and publishing pipelines, demonstrating a broader effort to abuse trusted software distribution channels.
A coordinated campaign instead of an isolated incident
According to Upwind, the attack extended across multiple components of the AsyncAPI ecosystem.
During its investigation, researchers confirmed that two separate GitHub repositories had been compromised. They also identified a second independent repository compromise, providing evidence that multiple publishing pipelines had been accessed during the campaign.
The attackers targeted different release branches and abused different OpenID Connect (OIDC) publishing identities within a short timeframe. Taken together, those findings indicate a coordinated operation aimed at trusted publishing infrastructure rather than a one-off compromise affecting a single package.
That distinction is significant because compromising multiple release processes can broaden the potential impact of an attack while making it more difficult to identify the initial point of compromise.
Legitimate software, malicious behavior
The investigation also sheds light on how attackers are adapting the way malicious code is delivered.
Instead of relying on traditional preinstall or postinstall scripts, which many security tools are designed to monitor, the malicious code executed during normal package imports or through alternative execution paths.
By embedding execution within expected application behavior, attackers reduce the likelihood that conventional installation-focused security controls will detect suspicious activity.
Upwind researchers also observed several execution techniques throughout the campaign. Although the methods differed, the attackers consistently reused the same infrastructure and malware patterns across multiple compromised repositories and publishing pipelines, suggesting a deliberate and coordinated approach.
Why organizations should pay attention
The compromised packages were distributed through official publishing channels and appeared legitimate to developers using standard dependency management practices.
As a result, organizations could unknowingly introduce malicious code into developer workstations and CI/CD environments simply by importing affected package versions during routine software development.
"This wasn't just a malicious package -it was a compromise of trust," said Amiram Shachar, CEO and Co-Founder of Upwind. "Multiple official AsyncAPI packages were published with backdoored code from separate repositories and publishing pipelines, showing that attackers are increasingly targeting the software release process itself."
The findings illustrate how the consequences of a compromised publishing pipeline extend beyond a single application. Once trusted release infrastructure is affected, every downstream environment that consumes those packages may also be placed at risk.
Practical steps following the investigation
Based on its findings, Upwind recommends that organizations review their software supply chains to identify whether affected package versions were introduced into development environments.
The company advises security teams to verify exact package versions instead of assuming recent releases are trustworthy. It also recommends pinning dependencies to verified versions and reviewing dependency updates, lockfiles, and Software Bills of Materials (SBOMs) for unexpected changes.
Developer workstations and CI/CD runners that imported the affected packages should be considered potentially compromised, according to Upwind, and any credentials accessible from those environments should be rotated.
A reminder that software trust must be continuously verified
The investigation highlights an ongoing shift in software security. Rather than focusing exclusively on applications, attackers are increasingly pursuing the infrastructure responsible for building and distributing software.
Upwind says this trend reinforces the importance of runtime visibility and continuous monitoring throughout the software development lifecycle. As malicious code becomes more capable of blending into normal application execution, organizations may need security capabilities that extend beyond static analysis and installation-time inspection to detect suspicious behavior after software begins running.
Written by TVC Analyst research group.
