Daniel Kocot; Short Talk
Event gateways are becoming a popular answer to a real problem in event-driven architecture: the lack of a clear control plane.
But they should not be understood as API gateways for events. Events have different failure modes. Ownership is less visible. Compatibility changes over time. Policies are harder to enforce without coupling producers and consumers again. Observability depends on more than traffic flowing through a single point.
This talk examines where event gateways are useful, where brokers, schema registries, catalogs, and portals already cover part of the problem, and where the gateway metaphor starts to break down.
The focus is not another infrastructure layer. The focus is which governance capabilities event-driven systems actually need, and how AsyncAPI can help describe them.
Ignacio Castillejos; Technical Deep Dive/Case Study
Migrating an event-driven architecture isn't just a change of broker. It means renegotiating contracts between every producer and consumer. In this talk, we share our journey from a legacy EDA built on GCP Pub/Sub and Avro to one built on AWS EventBridge, where every event follows the CloudEvents standard and the entire event API is defined by an AsyncAPI spec. We'll also show how those same events now power our data products.
We'll cover:
Why we changed. Routing messages on our legacy stack was hard, the setup carried too much infrastructure to maintain, and Avro depended on a schema registry we didn't control.
Contract-first events with AsyncAPI. We govern our event schemas contract-first, the same way we govern our REST APIs with OpenAPI, with the spec as the source of truth. We'll show how that replaced the external schema registry and what the workflow looks like day to day.
From events to data products. Because every event has a well-defined contract, the same events that drive our services land in our data lakehouse, where they're transformed into data marts and continuously monitored for quality.
Attendees will leave with practical lessons on using AsyncAPI to make events a reliable foundation for both services and data products.
Florence Njeri; Short Talk
Open-source packages are now the primary attack surface used by threat actors. Rather than targeting enterprises directly, attackers are now compromising widely-used packages with a goal of reaching millions of CI/CD systems simultaneously through trusted releases.
Because these open-source packages form the backbone of modern enterprise workflows, including cloud pipelines, CI/CD systems, and developer tooling, attackers are increasingly targeting open-source organizations to poison these packages and publish them to trusted registries such as npm and the VS Code Marketplace, compromising hundreds of downstream organizations simultaneously through trusted releases installed by their developers.
Over the past year, AsyncAPI faced two supply chain attacks by TeamPCP and Miasma, compromising packages with up to 4M+ combined weekly downloads, such as:
- @asyncapi/specs (4M+ weekly)
- @asyncapi/generator (~130k weekly)
- Official VS Code extensions
This session presents the tactics, techniques, and procedures (TTPs) we saw used in both incidents. We will trace how a single compromised release propagates into enterprise and public sector environments across Europe and France.
Finally, attendees will gain actionable defense strategies and tools we have been using to tighten our security measures. We will showcase how we overhauled our release pipelines using:
- OIDC Trusted Publishing
- Automated CI/CD security scanning of every workflow change before it can release
- Hardened token isolation
- SHA-pinned GitHub Actions
- Least-privilege permission scopes on automation bots
Attendees will leave with practical resources and tools to audit their own GitHub Actions, build pipelines, and IDE extension supply chains against active threat groups.
The Technical Incidents:
This section of the talk will provides first-hand incident response account from the AsyncAPI Initiative security team following two real-world software supply-chain compromises orchestrated by threat groups TeamPCP and Miasma.
- Exploitation of GitHub Actions pull_request_target workflows (pwn requests) to steal elevated repository secrets.
- Spam pull requests used to hide the real attack in the workflow logs, and a docs PR using an MDX file to run attacker code in our build pipeline.
- How the attackers released compromised packages with trusted credentials releasing malicious builds of @asyncapi/specs, @asyncapi/generator, and developer VS Code extensions directly to npm and the VS Code Marketplace, including one release through our own OIDC pipeline.
Direct Impact of Supply Chain Attacks for Financial Sector Attendees in France and the EU:
For banking, fintech, and public sector ecosystems in France and the EU operating under strict EU regulatory frameworks like DORA and NIS2, open-source packages and developer extensions represent an unmonitored third-party dependency vector. A poisoned upstream library imported into an internal financial pipeline or a developer’s IDE circumvents traditional perimeter controls.
Actionable Takeaways:
Attendees will leave with practical blueprints we implemented to remediate and harden our release infrastructure and further insights on how to protect their organizations from being compromised through supply chain attacks.