M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

Analysis of a supply chain attack on AsyncAPI exploiting a pwn request vulnerability in GitHub Actions, resulting in malicious npm packages with multi-stage payloads.