security(deps): pin @asyncapi packages to non-compromised versions (#316)

Several AsyncAPI npm packages were briefly compromised on 2026-07-14 (the "Miasma RAT" supply-chain incident, delivered via a post-install sync.js dropper). sei-js pulls @asyncapi/specs transitively through mint -> @asyncapi/parser, whose range can float up into the compromised 6.11.2 on any fresh install or lockfile regeneration.

Pin the four affected packages to their latest non-compromised versions via pnpm.overrides so no install can resolve a malicious release. Adds a patch changeset across all six published packages and records the fix in the root CHANGELOG (2.0.0 -> 2.0.1) to ship it as a coordinated release.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: alexander-sei

.changeset/security-pin-asyncapi.md

@@ -0,0 +1,14 @@
+---
+"@sei-js/create-sei": patch
+"@sei-js/ledger": patch
+"@sei-js/mcp-server": patch
+"@sei-js/precompiles": patch
+"@sei-js/registry": patch
+"@sei-js/sei-global-wallet": patch
+---
+
+Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`.
+
+This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively.
+
+No shipped code or public API changes in this package — this is a repository/CI hardening release.

CHANGELOG.md

@@ -1 +1,15 @@
 # Changelog
+
+## 2.0.1 — 2026-07-22
+
+### Security
+
+- Pin `@asyncapi/*` packages to non-compromised versions via `pnpm.overrides`, in
+  response to the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident. Stops a
+  fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the
+  compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`).
+  - Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`.
+  - `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components`
+    pinned preventively (not currently in the tree).
+  - No published `@sei-js/*` package's code or public API changes. A coordinated
+    patch release across all six packages carries this note for consumer visibility.

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "sei-js",
-	"version": "2.0.0",
+	"version": "2.0.1",
 	"private": true,
 	"license": "MIT",
 	"scripts": {
@@ -25,5 +25,13 @@
 		"ts-node": "2.1.2",
 		"typescript": "^5.8.2"
 	},
-	"packageManager": "pnpm@9.0.0"
+	"packageManager": "pnpm@9.0.0",
+	"pnpm": {
+		"overrides": {
+			"@asyncapi/specs": "6.11.1",
+			"@asyncapi/generator": "3.3.0",
+			"@asyncapi/generator-helpers": "1.1.0",
+			"@asyncapi/generator-components": "1.0.0"
+		}
+	}
 }