Published analysis of the AsyncAPI npm compromise describes payload delivery occurring at import time — when application code loads the module — rather than during installation.
The distinction sounds academic. It is the difference between a control working and not working.
What The Standard Mitigation Actually Covers
After the install-time credential-theft campaigns, the widely issued advice was to disable install scripts in continuous integration. Teams that acted on it added a flag to their pipeline configuration and reasonably considered the class of attack addressed.
That flag prevents code running during dependency installation. It has no effect on code that runs when the module is imported, because importing a module is the entire purpose of installing it. A build that compiles, a test suite that runs, a linter that resolves types — each loads the package, and the payload executes with whatever that process holds.
The Pattern To Expect
This is a mitigation-relocation cycle, and it is worth naming because it will repeat. A control is deployed at a specific point in the lifecycle. Attackers move one step along it. The control remains correctly configured and stops covering the attack.
The durable defences are the ones that do not depend on where execution happens: credentials scoped to a single job and expiring with it, egress restrictions on build runners, and publish rights that a build environment cannot read. None of those care when the code runs.
Compiled from published vendor research, listed below. We did not analyse samples ourselves. Corrections: corrections@forensicpost.com.