security(deps): pin @asyncapi packages to non-compromised versions#316
Conversation
Several AsyncAPI npm packages were briefly compromised on 2026-07-14 (the "Miasma RAT" supply-chain incident, delivered via a post-install sync.js dropper). sei-js pulls @asyncapi/specs transitively through mint -> @asyncapi/parser, whose "^6.8.0" range can float up into the compromised 6.11.2 on any fresh install or lockfile regeneration. Pin the four affected packages to their latest non-compromised versions via pnpm.overrides so no install can resolve a malicious release: @asyncapi/specs 6.11.1 (in tree: 6.10.0 -> 6.11.1) @asyncapi/generator 3.3.0 (preventive; not in tree) @asyncapi/generator-helpers 1.1.0 (preventive; not in tree) @asyncapi/generator-components 1.0.0 (preventive; not in tree) No compromised version was ever present in the lockfile. The only resolved change is @asyncapi/specs 6.10.0 -> 6.11.1; the generator pins are defense-in-depth in case that toolchain is introduced later. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: 7b6a0d0 The changes in this PR will be included in the next version bump. This PR includes changesets to release 6 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
PR SummaryLow Risk Overview Workspace version is bumped to 2.0.1 with Reviewed by Cursor Bugbot for commit 7b6a0d0. Bugbot is set up for automated code reviews on this repo. Configure here. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #316 +/- ##
=======================================
Coverage 79.75% 79.75%
=======================================
Files 83 83
Lines 1309 1309
Branches 160 160
=======================================
Hits 1044 1044
Misses 265 265 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Add a patch changeset across all six published packages and record the fix in the root CHANGELOG (2.0.0 -> 2.0.1) so the AsyncAPI supply-chain hardening ships as a coordinated release via the changesets flow. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
3 participants
Summary
Hardens sei-js against the 2026-07-14 AsyncAPI npm supply-chain
compromise ("Miasma RAT", dropped via a post-install
sync.js) bypinning the affected
@asyncapi/*packages to their latestnon-compromised versions through
pnpm.overrides.Background
During a ~4-hour window on 2026-07-14, these versions were malicious:
@asyncapi/specs@asyncapi/generator@asyncapi/generator-helpers@asyncapi/generator-componentsHow sei-js is exposed
sei-js has no direct
@asyncapidependency, but themint(Mintlify)docs CLI pulls it transitively:
mint → @asyncapi/parser@3.4.0 → @asyncapi/specs "^6.8.0"That
^6.8.0range floats, so a fresh install or lockfileregeneration could have resolved the compromised
6.11.2. Nocompromised version was ever actually in
pnpm-lock.yaml(it waspinned at
6.10.0), and thegenerator*packages are not in the treeat all.
What changed
package.json: added apnpm.overridesblock pinning the fourpackages above.
pnpm-lock.yaml:@asyncapi/specs 6.10.0 → 6.11.1(the onlyresolved version change) + the recorded
overridessection.generator*pins add no packages — they're defense-in-depthso the compromised releases can never enter the tree if AsyncAPI
codegen is adopted later.
deprecated:lines in the lockfile diff are registry metadatapnpm refreshed during the rewrite — no versions or integrity hashes
changed.
Verification
pnpm install --lockfile-onlyis idempotent (second run = no furtherchanges) →
--frozen-lockfileCI will pass.@asyncapi/specsnow resolves to a single version,6.11.1.Notes
dev/CI install (docs tooling); it is not published into any package's
metadata, so consumers of sei-js packages are unaffected.
🤖 Generated with Claude Code