Upwind links AsyncAPI npm attack to release process

Cloud security company Upwind found a coordinated attack compromised multiple official AsyncAPI npm packages through separate GitHub repositories and publishing pipelines. Malicious code executed during normal package imports, not installation scripts. Developer workstations and CI/CD environments that imported affected packages should be treated as potentially compromised.