Security notice: AsyncAPI npm supply chain compromise — Mintlify is not affected

What to do

• Check whether your product depends on Mintlify. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2026-07-16 18:54 UTC and 2026-07-16 18:54 UTC may need a replay.

• Subscribe to Mintlify's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=mintlify works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Mintlify 1

1. resolvedJul 16, 2026, 6:54 PM UTC

   On July 14, 2026, several packages in the `@asyncapi` npm namespace were compromised in a supply chain attack. An attacker exploited a misconfigured GitHub Actions workflow in the AsyncAPI generator repository to steal a publish token and release malicious versions of `@asyncapi/specs` (6.11.2, 6.11.2-alpha.1), `@asyncapi/generator` (3.3.1), `@asyncapi/generator-components` (0.7.1), and `@asyncapi/generator-helpers` (1.1.1). We reviewed our dependency tree and confirmed Mintlify is not affected: - We do not use `@asyncapi/generator`, `@asyncapi/generator-helpers`, or `@asyncapi/generator-components` anywhere in our codebase. - The only `@asyncapi` packages we depend on are `@asyncapi/parser` (not compromised) and `@asyncapi/specs`, which our lockfiles pin at 6.11.1 and 6.8.1 — both below the compromised 6.11.2. We will keep specs pinned below 6.11.2. - The malicious versions were never installed in our development, CI, or production environments, and we found no signs of impact. Mintlify's AsyncAPI documentation features continue to work normally and were never at risk. No action is required on your part.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.