# AsyncAPI: Parallel Publishing-Identity Compromise with Import-Time Execution

- **Artifact ID:** CHQ-EX-2026-023
- **Public record:** https://record.cybersecurityhq.com/exhibits/chq-ex-2026-023
- **Machine-record SHA-256:** `8f62b14fd658c50908dce80f854b427a8ccd52fc48aa39b222aca52d1e816355`

## Complete structured record

```json
{
  "id": "CHQ-EX-2026-023",
  "title": "AsyncAPI: Parallel Publishing-Identity Compromise with Import-Time Execution",
  "subtitle": "A coordinated campaign backdoored multiple official packages in the AsyncAPI npm ecosystem in July 2026. The campaign held several publishing pipelines and several OIDC publishing identities simultaneously, and its payload executed at package import rather than through installation lifecycle scripts.",
  "classification_notice": [
    "This document is published as a CHQ Exhibit. It records historical conditions, breach events, and industry practices as they existed during the periods described. This Exhibit records observed conditions, exploitation mechanics, and structural patterns as documented in public disclosures, security research publications, and vendor advisories during the stated period.",
    "This document does not address present conditions and carries no current applicability. No evaluation of past practices is intended or implied.",
    "CHQ Exhibits are not superseded by later artifacts unless explicitly invalidated for factual error."
  ],
  "metadata": {
    "artifact_class": "EXHIBIT",
    "temporal_scope": "OPERATIONAL (JULY 2026)",
    "authority_level": "NON-JUDGMENTAL",
    "reliance_status": "EXHIBIT_ONLY",
    "update_policy": "ERRATA_ONLY",
    "temporal_start": "2026-07-01",
    "temporal_end": "2026-07-31"
  },
  "sections": [
    {
      "heading": "I. Factual Record",
      "content": [
        "Disclosure: Managed detection researchers published the campaign in July 2026 following investigation in customer environments. The disclosure documented compromise of multiple official packages in the AsyncAPI ecosystem, which provides specification tooling for event-driven architectures.",
        "Repository Compromise: Two source repositories associated with the project were compromised, and a further independent repository compromise was documented in the same campaign. Shared infrastructure and shared malware across the compromised pipelines were reported as the basis for treating the activity as a single coordinated operation rather than parallel opportunistic compromises.",
        "Publishing Identity Scope: The campaign abused multiple OIDC publishing identities across different release branches within a short period. Each identity was individually valid and individually authorized to publish. The campaign's access did not depend on any single credential.",
        "Provenance State: The backdoored versions were published through legitimate release channels. Provenance verification confirmed that the packages were published by the identities entitled to publish them. Verification confirmed lineage. It did not confirm that the parties exercising those identities were the parties the identities belonged to.",
        "Execution Vector: The malicious code executed at package import rather than through preinstall or postinstall lifecycle scripts. Scanning that inspects installation behavior did not evaluate the code path that executed. Public reporting recorded this as a deliberate evasion property of the campaign.",
        "Downstream Exposure: The disclosure recommended treating both developer workstations and continuous integration runners that imported affected versions as potentially compromised, and rotating secrets reachable from those environments."
      ]
    },
    {
      "heading": "II. Failure Pattern",
      "content": [
        "Two structural properties are recorded here that the prior waves in this lineage did not exhibit.",
        "The first is redundancy of publishing authority within a single campaign. Prior documented supply chain compromises in this lineage proceeded through a compromised maintainer credential or a compromised pipeline, where revoking the credential or securing the pipeline addressed the campaign's access. This campaign held several pipelines and several publishing identities in parallel. Revoking any one of them would have left the others operative. The remediation unit and the compromise unit were not the same size.",
        "The second is the migration of the execution vector to import time. Exhibit CHQ-EX-2026-021 recorded a migration from package lifecycle scripts to development environment and coding agent auto-run hooks. This campaign records a further migration, to the ordinary act of importing a dependency into a running application. The structural significance is the same in both cases: execution moved to a surface that installed tooling generally does not instrument.",
        "A third element carries forward from adjacent exhibits rather than originating here. Every backdoored version presented valid publishing provenance. The verification infrastructure confirmed the campaign succeeded. The compromise occurred upstream of the integrity boundary that the verification checks.",
        "The boundary between this exhibit and adjacent exhibits matters. This campaign shares its structural class with the multi-registry compromises recorded in CHQ-EX-2026-009, CHQ-EX-2026-014, CHQ-EX-2026-017, and CHQ-EX-2026-021. It is recorded separately because parallel publishing identity redundancy and import-time execution are not present in those exhibits. Actor relationship to those campaigns was not established at disclosure and no lineage claim is made here."
      ]
    },
    {
      "heading": "III. Referenced By",
      "content": [
        "CHQ-P-2026-013 — Position: Portable Developer Identity Cannot Contain Credential Compromise Across Registries. (Parallel identity compromise within one campaign.)",
        "CHQ-P-2026-015 — Position: Execution Pipelines Function as Control Planes Without Verification Primitives Capable of Validating the Authority They Execute. (Pipelines executed compromised publishing authority.)",
        "CHQ-P-2026-016 — Position: Cryptographic Provenance Systems Validate Continuity of Authorization, Not Correctness of Authorization. (Valid provenance on compromised authority.)"
      ]
    }
  ],
  "closing_statement": "This Exhibit records historical conditions. It carries no present applicability. No judgment is made about any organization, vendor, security posture, or attribution conclusion.\n\nTemporal scope: July 2026. Exhibit issuance date is July 24, 2026. This Exhibit records findings as reported by named security research organizations, not as established fact.\n\nSources: Upwind managed detection and response research; contemporaneous industry reporting.",
  "hash_scope": "Full exhibit content body",
  "hash_generated": "2026-07-24"
}
```