The AsyncAPI organization was compromised on July 14, 2026, as part of a supply chain attack labelled Miasma. You can read the AsyncAPI team’s assessment and breakdown of the incident here. Stoplight Spectral was affected due to a caret (^) in the dependencies block for `@asyncapi/specs` and the notation “^6.8.0” for the version number. This means that unless a user installed via a cached install (npm ci), the lockfile resolution won’t be completely accurate, as the caret allows for fix and minor revisions to be downloaded immediately by new npm (non-cached) installs. For the few hours of the Miasma supply chain attack ( 08:06 UTC – 11:18 UTC on July 14 for the affected @asyncapi/specs@6.11.2-alpha.1 package), those who installed the latest version of Spectral, without a cached install, may be subject to compromise.
Why was Spectral impacted?
Spectral helps many individuals and organizations to enforce governance and standardizations across API definitions, to ensure they adhere to both the API specifications themselves, and any rule sets you wish to apply, either off the shelf, borrowing from others API experience, or building to own, to constrain APIs within your organization.
With over 3,200 forks, 8,300 dependent repositories, 128 packages, an unknown number of users, and providing the backbone for API governance in SmartBear Swagger Studio, we collectively need to ensure its health and security for years to come.
With this success comes challenges. Currently there are 239 open issues and 40 pull requests, many of which come from external contributors. Our engineering teams work both on commercial and open-source projects, and along with many of you, work in sprints. This means their time is allocated for the next two weeks, with some contingency capacity. OSS contributions may come day or night, on the weekend, or in the middle of a high-pressure deliverable. Each issue or fix requires triage, and potentially context switching or knowledge-gaining to understand the root cause, or appropriately review contributions.
What may not be so visible, beyond the major OSS projects we maintain (e.g. Stoplight Elements; Prism and Spectral; SmartBear SoapUI / Swagger UI/Editor/CodeGen; and Pact’s client libraries and Pact Broker), there are numerous smaller repositories which make up this ecosystem. So, what may look like a small project to a contributor on the surface runs far deeper underneath.
The key to covering this OSS management at scale, is automation. Many projects use dependency management tooling and security scanners as part of a VCS, or third-party. These tend to run on schedules, or as a new dependency is published, but there is often a delay between publishing to the registry, and proliferation through the ecosystem via dependency management tooling. As the AsyncAPI team worked quickly with the NPM team to remove the affected packages, our dependency scanners did not run during this brief period.
What we have done
Pinned the versions of the AsyncAPI dependency as part of this pr removing the caret, ensuring that lockfile resolution will remain the same regardless of using a cached or non-cached install of Spectral
What you should do as a Spectral user
We would recommend reviewing the Indicators of Compromise, updating to the latest version of Spectral, v6.16.3 at time of publishing, ensuring you use a pinned version and preferring cached installs, to ensure lock-file resolution across machines.
What SmartBear is doing
We are now in the process of reviewing our GitHub assets, pipelines, organization access, and dependency management, to both reduce and mitigate supply chain attacks that are ever-increasing in frequency.
What if an issue occurs with Spectral again?
If you spot something that looks amiss, please head over to the SmartBear security page and submit a vulnerability.
A thank you from SmartBear
We’re pleased to steward API governance via Spectral, and are appreciative of every one of our issue creators, pull-request openers, commenters, and end users, both open-source and commercial via Swagger Studio. Thank you for using the software and striving to make it better, as every change makes API governance more accessible. We look forward to continuing stewardship alongside you, as it is pivotal to our story and your continued success with Spectral.
To find out more about how and why API governance is an imperative, especially given the rapid pace of software development, read our article AI tools and API governance: Here’s why you need both.
