From d2c1983127f9e5527583093e16b1ba808362f7a2 Mon Sep 17 00:00:00 2001 From: alexander-sei Date: Mon, 20 Jul 2026 16:35:58 +0200 Subject: [PATCH 1/2] security(deps): pin @asyncapi packages to non-compromised versions Several AsyncAPI npm packages were briefly compromised on 2026-07-14 (the "Miasma RAT" supply-chain incident, delivered via a post-install sync.js dropper). sei-js pulls @asyncapi/specs transitively through mint -> @asyncapi/parser, whose "^6.8.0" range can float up into the compromised 6.11.2 on any fresh install or lockfile regeneration. Pin the four affected packages to their latest non-compromised versions via pnpm.overrides so no install can resolve a malicious release: @asyncapi/specs 6.11.1 (in tree: 6.10.0 -> 6.11.1) @asyncapi/generator 3.3.0 (preventive; not in tree) @asyncapi/generator-helpers 1.1.0 (preventive; not in tree) @asyncapi/generator-components 1.0.0 (preventive; not in tree) No compromised version was ever present in the lockfile. The only resolved change is @asyncapi/specs 6.10.0 -> 6.11.1; the generator pins are defense-in-depth in case that toolchain is introduced later. Co-Authored-By: Claude Opus 4.8 --- package.json | 10 +++++++++- pnpm-lock.yaml | 27 +++++++++++++++++++++------ 2 files changed, 30 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index f839277c5..e49b79fc8 100644 --- a/package.json +++ b/package.json @@ -25,5 +25,13 @@ "ts-node": "2.1.2", "typescript": "^5.8.2" }, - "packageManager": "pnpm@9.0.0" + "packageManager": "pnpm@9.0.0", + "pnpm": { + "overrides": { + "@asyncapi/specs": "6.11.1", + "@asyncapi/generator": "3.3.0", + "@asyncapi/generator-helpers": "1.1.0", + "@asyncapi/generator-components": "1.0.0" + } + } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 4af8e54b8..6a72d1100 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,12 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + '@asyncapi/specs': 6.11.1 + '@asyncapi/generator': 3.3.0 + '@asyncapi/generator-helpers': 1.1.0 + '@asyncapi/generator-components': 1.0.0 + importers: .: @@ -227,8 +233,8 @@ packages: '@asyncapi/parser@3.4.0': resolution: {integrity: sha512-Sxn74oHiZSU6+cVeZy62iPZMFMvKp4jupMFHelSICCMw1qELmUHPvuZSr+ZHDmNGgHcEpzJM5HN02kR7T4g+PQ==} - '@asyncapi/specs@6.10.0': - resolution: {integrity: sha512-vB5oKLsdrLUORIZ5BXortZTlVyGWWMC1Nud/0LtgxQ3Yn2738HigAD6EVqScvpPsDUI/bcLVsYEXN4dtXQHVng==} + '@asyncapi/specs@6.11.1': + resolution: {integrity: sha512-A3WBLqAKGoJ2+6FWFtpjBlCQ1oFCcs4GxF7zsIGvNqp/klGUHjlA3aAcZ9XMMpLGE8zPeYDz2x9FmO6DSuKraQ==} '@babel/code-frame@7.27.1': resolution: {integrity: sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==} @@ -575,6 +581,7 @@ packages: '@cosmjs/crypto@0.32.4': resolution: {integrity: sha512-zicjGU051LF1V9v7bp8p7ovq+VyC91xlaHdsFOTo2oVry3KQikp8L/81RkXmUIT8FxMwdx1T7DmFwVQikcSDIw==} + deprecated: This uses elliptic for cryptographic operations, which contains several security-relevant bugs. To what degree this affects your application is something you need to carefully investigate. See https://github.com/cosmos/cosmjs/issues/1708 for further pointers. Starting with version 0.34.0 the cryptographic library has been replaced. However, private keys might still be at risk. '@cosmjs/encoding@0.32.4': resolution: {integrity: sha512-tjvaEy6ZGxJchiizzTn7HVRiyTg1i4CObRRaTRPknm5EalE13SV+TCHq38gIDfyUeden4fCuaBVEdBR5+ti7Hw==} @@ -1483,6 +1490,7 @@ packages: '@mintlify/cli@4.0.701': resolution: {integrity: sha512-TWxZqPivFvfxMHpHcfYwIWFOpLYxw0v0SUiIVfIVbLkF8IVf29GhaXsqXMdnWqqz0WujDc4nicZUMzIW8JaFDg==} engines: {node: '>=18.0.0'} + deprecated: This version is deprecated. Please upgrade to version 4.0.423 or later. hasBin: true '@mintlify/common@1.0.513': @@ -2048,6 +2056,7 @@ packages: '@ungap/structured-clone@1.3.0': resolution: {integrity: sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==} + deprecated: Potential CWE-502 - Update to 1.3.1 or higher '@unrs/resolver-binding-android-arm-eabi@1.11.1': resolution: {integrity: sha512-ppLRUgHVaGRWUx0R0Ut06Mjo9gBaBkg3v/8AxusGLhsIotbBLuRk51rAzqLC8gq6NyyAojEXglNjzf6R948DNw==} @@ -2567,6 +2576,7 @@ packages: basic-ftp@5.0.5: resolution: {integrity: sha512-4Bcg1P8xhUuqcii/S0Z9wiHIrQVPMermM1any+MX5GeGD7faD3/msQUDGLol9wOcz4/jbg/WJnGqoJF6LiBdtg==} engines: {node: '>=10.0.0'} + deprecated: Security vulnerability fixed in 5.2.1, please upgrade bech32@1.1.4: resolution: {integrity: sha512-s0IrSOzLlbvX7yp4WBfPITzpAU8sqQcpsmwXDiKwrG4r491vwCO/XpejasRNl0piBMe/DvP4Tz0mIS/X1DPJBQ==} @@ -3633,11 +3643,12 @@ packages: glob@10.4.5: resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==} + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me hasBin: true glob@7.2.3: resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==} - deprecated: Glob versions prior to v9 are no longer supported + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me globalthis@1.0.4: resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==} @@ -4864,6 +4875,7 @@ packages: mint@4.2.97: resolution: {integrity: sha512-4DDWOJ1qQPgq+kWHQDApcPVsC3NLoEqlEauiMWF8CGQx+StgPYH/tipQaS7v1F9qBsSxBaZ8GTw8n08YOmSZKA==} engines: {node: '>=18.0.0'} + deprecated: This version is deprecated. Please upgrade to version 4.0.423 or later. hasBin: true mipd@0.0.7: @@ -5305,6 +5317,7 @@ packages: prebuild-install@7.1.3: resolution: {integrity: sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==} engines: {node: '>=10'} + deprecated: No longer maintained. Please contact the author of the relevant native addon; alternatives are available. hasBin: true prettier@2.8.8: @@ -5367,7 +5380,7 @@ packages: puppeteer@22.15.0: resolution: {integrity: sha512-XjCY1SiSEi1T7iSYuxS82ft85kwDJUS7wj1Z0eGVXKdtr5g4xnVcbjwxhq5xBnpK/E7x1VZZoJDxpjAOasHT4Q==} engines: {node: '>=18'} - deprecated: < 24.9.0 is no longer supported + deprecated: < 24.15.0 is no longer supported hasBin: true pure-rand@6.1.0: @@ -6004,6 +6017,7 @@ packages: tar@6.2.1: resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==} engines: {node: '>=10'} + deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me term-size@2.2.1: resolution: {integrity: sha512-wK0Ri4fOGjv/XPy8SBHZChl8CM7uMc5VML7SqiQ0zG7+J5Vr+RMQDoHa2CNT6KHUnTGIXH34UDMkPzAUyapBZg==} @@ -6345,6 +6359,7 @@ packages: uuid@8.3.2: resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==} + deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). hasBin: true v8-compile-cache-lib@3.0.1: @@ -6667,7 +6682,7 @@ snapshots: '@asyncapi/parser@3.4.0': dependencies: - '@asyncapi/specs': 6.10.0 + '@asyncapi/specs': 6.11.1 '@openapi-contrib/openapi-schema-to-json-schema': 3.2.0 '@stoplight/json': 3.21.0 '@stoplight/json-ref-readers': 1.2.2 @@ -6689,7 +6704,7 @@ snapshots: transitivePeerDependencies: - encoding - '@asyncapi/specs@6.10.0': + '@asyncapi/specs@6.11.1': dependencies: '@types/json-schema': 7.0.15 From 7b6a0d0ae2f57bee4463927f85c3e03ab40aea45 Mon Sep 17 00:00:00 2001 From: alexander-sei Date: Wed, 22 Jul 2026 21:26:41 +0200 Subject: [PATCH 2/2] security(deps): add changeset + workspace changelog for asyncapi pin Add a patch changeset across all six published packages and record the fix in the root CHANGELOG (2.0.0 -> 2.0.1) so the AsyncAPI supply-chain hardening ships as a coordinated release via the changesets flow. Co-Authored-By: Claude Opus 4.8 --- .changeset/security-pin-asyncapi.md | 14 ++++++++++++++ CHANGELOG.md | 14 ++++++++++++++ package.json | 2 +- 3 files changed, 29 insertions(+), 1 deletion(-) create mode 100644 .changeset/security-pin-asyncapi.md diff --git a/.changeset/security-pin-asyncapi.md b/.changeset/security-pin-asyncapi.md new file mode 100644 index 000000000..e8e8a173e --- /dev/null +++ b/.changeset/security-pin-asyncapi.md @@ -0,0 +1,14 @@ +--- +"@sei-js/create-sei": patch +"@sei-js/ledger": patch +"@sei-js/mcp-server": patch +"@sei-js/precompiles": patch +"@sei-js/registry": patch +"@sei-js/sei-global-wallet": patch +--- + +Harden the workspace against the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident by pinning `@asyncapi/*` packages to non-compromised versions via root `pnpm.overrides`. + +This stops a fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`; `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` are pinned preventively. + +No shipped code or public API changes in this package — this is a repository/CI hardening release. diff --git a/CHANGELOG.md b/CHANGELOG.md index 825c32f0d..a8de5d9e6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1 +1,15 @@ # Changelog + +## 2.0.1 — 2026-07-22 + +### Security + +- Pin `@asyncapi/*` packages to non-compromised versions via `pnpm.overrides`, in + response to the 2026-07-14 "Miasma RAT" AsyncAPI supply-chain incident. Stops a + fresh install or lockfile regeneration from floating `@asyncapi/specs` up into the + compromised `6.11.2` through the `mint` docs toolchain (`mint` → `@asyncapi/parser`). + - Resolved change: `@asyncapi/specs` `6.10.0` → `6.11.1`. + - `@asyncapi/generator`, `@asyncapi/generator-helpers`, and `@asyncapi/generator-components` + pinned preventively (not currently in the tree). + - No published `@sei-js/*` package's code or public API changes. A coordinated + patch release across all six packages carries this note for consumer visibility. diff --git a/package.json b/package.json index e49b79fc8..4af7e9348 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "sei-js", - "version": "2.0.0", + "version": "2.0.1", "private": true, "license": "MIT", "scripts": {