Five package versions, including specs at roughly 2 million weekly downloads, shipped an obfuscated dropper on 2026-07-14. Here is what we have confirmed so far. Category: Vulnerabilities & Threats
AsyncAPI npm packages backdoored via GitHub Actions
calendar_today
July 14, 2026
domain
aikido-security