AsyncAPI npm packages infected with credential-stealing malware

A supply-chain attack published five malicious AsyncAPI packages to npm, delivering a remote access trojan with info-stealing capabilities. The attack's impact and scope are uncertain.