AsyncAPI npm Supply Chain Attack: Malware Injected Into Packages With 2 Million Weekly Downloads

AsyncAPI npm packages (including @asyncapi/generator 3.3.1, @asyncapi/generator-components 0.7.1, @asyncapi/generator-helpers 1.1.1, and @asyncapi/specs 6.11.2/6.11.2-alpha.1) were compromised with a 91,973-line malicious payload that acts as a hybrid info-stealer, crypto-stealer and RAT; the malware uses IPFS and BitTorrent bootstrap nodes for resilient C2 (primary C2 observed at 85.137.53.71), checks for VM/EDR/Russian locale to evade analysis, can publish to npm/PyPI/Cargo if it finds credentials, and has an embedded Ethereum address, prompting urgent revocation of tokens, secret rotation, and audit of package releases.