# AsyncAPI Specification

The AsyncAPI Specification describes message-driven APIs in a machine-readable, protocol-agnostic format.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)

DevFeed: [AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)](<https://devfeed.tech/articles/asyncapi-supply-chain-compromise-npm-packages-backdoored-via-github-actions-pwn-request-july-2026-12890.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/asyncapi-supply-chain-compromise-npm-packages-backdoored-via-github-actions>)

Published: 2026-07-14T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [AsyncAPI Specification](<https://devfeed.tech/topics/asyncapi.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Remote Access Trojan](<https://devfeed.tech/topics/remote-access-trojan.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [ssh](<https://devfeed.tech/topics/ssh.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Cryptocurrency](<https://devfeed.tech/topics/cryptocurrency.md>)

Tags: [asyncapi-supply-chain-attack](<https://devfeed.tech/tags/asyncapi-supply-chain-attack.md>), [chainguard-asyncapi](<https://devfeed.tech/tags/chainguard-asyncapi.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [ci](<https://devfeed.tech/tags/ci.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [cryptocurrency](<https://devfeed.tech/tags/cryptocurrency.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [github-actions-pwn-request](<https://devfeed.tech/tags/github-actions-pwn-request.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [malware](<https://devfeed.tech/tags/malware.md>), [miasma](<https://devfeed.tech/tags/miasma.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [personal-access-token](<https://devfeed.tech/tags/personal-access-token.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

### AI overview

The article analyzes a July 14, 2026 supply-chain compromise in which an attacker stole a privileged GitHub personal access token through a misconfigured GitHub Actions workflow and used it to publish five backdoored versions across four AsyncAPI npm packages. The malware activates when a library is loaded by a build or CI job and steals browser passwords, SSH keys, npm and GitHub tokens, cloud credentials, and cryptocurrency wallets while maintaining command-and-control access. It also explains why Chainguard customers were protected and recommends treating affected environments as compromised and rotating credentials.

### Source excerpt

A supply chain attack compromised AsyncAPI npm packages via GitHub Actions. See how Chainguard blocked the malicious releases by design.

## Random Things I Liked, Mar 2023

DevFeed: [Random Things I Liked, Mar 2023](<https://devfeed.tech/articles/random-things-i-liked-mar-2023-38431.md>)

Original publisher: [Read original article](<https://khmylov.com/2023/03/random-things-i-liked-mar-2023/>)

Author: Andrew Khmylov

Published: 2023-03-27T00:00:00Z

Content type: opinion

Language: en

Sources: [Despite the odds](<https://devfeed.tech/sources/despite-the-odds.md>)

Topics: [LLMs](<https://devfeed.tech/topics/llms.md>), [AsyncAPI Specification](<https://devfeed.tech/topics/asyncapi.md>), [diffusion-transformers](<https://devfeed.tech/topics/diffusion-transformers.md>), [Concurrent Programming](<https://devfeed.tech/topics/concurrent-programming.md>), [Prompt Engineering](<https://devfeed.tech/topics/prompt-engineering.md>), [OCaml](<https://devfeed.tech/topics/ocaml.md>), [OpenAPI Specification](<https://devfeed.tech/topics/openapi.md>)

Tags: [diffusion](<https://devfeed.tech/tags/diffusion.md>), [language-models](<https://devfeed.tech/tags/language-models.md>), [ocaml](<https://devfeed.tech/tags/ocaml.md>), [openapi](<https://devfeed.tech/tags/openapi.md>), [programming](<https://devfeed.tech/tags/programming.md>), [reasoning](<https://devfeed.tech/tags/reasoning.md>)

### AI overview

A personal roundup of developer topics and papers the author liked in March 2023, covering Automerge 2.0, AsyncAPI for event-based architecture, using external tools with large language models, diffusion-based image reconstruction from brain activity, effect handlers in OCaml, and prompt-based perspectives on LLM behavior.

### Source excerpt

Automerge 2.0 https://automerge.org/blog/automerge-2/ The complete rewrite of Automerge dropped right after discussing CRDTs optimizations the last time, addressing performance concerns. AsyncAPI https://www.asyncapi.com/docs It's like Swagger/OpenAPI, but for event-based architecture. I've been working with events and messages for quite a long time now, and tried some approaches to spec description, like Protocol Buffers, but it just didn't feel right. Too much hassle and not so much benefits. I'm eager to try this one though. LLMs + external tools = 🔥 As of today, large language models are trained on "static" data sets, they don't have a memory, and don't know about the world around them. However, if the only thing they do and do so extremely well is predicting next token, it's only natural to wonder "why can't we teach the model to predict some API call when it needs external data?". There have been a couple of papers on that topic: Toolformer: Language Models Can Teach Themselves to Use Tools ReAct: Synergizing Reasoning and Acting in Language Models Reading your mind with diffusion models I've already noticed multiple times that casual news headlines today sound exactly like futuristic imaginations from the original Deus Ex game, but this paper, "High-resolution image reconstruction with latent diffusion models from human brain activity", takes it to the next level. The research behind this has been going on for more than a decade, and the recent advances in computational capabilities and diffusion models accelerated the progress. Concurrent Programming with Effect Handlers https://github.com/ocaml-multicore/ocaml-effects-tutorial Every developer is familiar with exceptions. Algebraic effects take them to the next level of abstraction, and expose the manipulation of control flow as a first-class citizen. This is a nice write-up and a collection of examples of various effects implementations in OCaml. The Waluigi Effect https://www.lesswrong.com/posts/D7PumeYTDP