npm supply chain

On March 31, 2026, a malicious npm package update turned Axios, one of the JavaScript ecosystem’s most ubiquitous HTTP clients, into the latest reminder that software trust can be weaponized at scale. The compromise was brief, but the blast radius was broad: malicious versions were published...

On March 31, 2026, one of the JavaScript ecosystem’s most ubiquitous utilities became the center of a supply chain crisis: malicious versions of axios were published to npm and used to deliver a cross-platform remote access trojan to developers and CI environments. The incident matters far...

The compromise of Axios, one of the JavaScript ecosystem’s most widely used HTTP clients, is a reminder that the biggest software supply-chain threats often begin with the smallest human mistake. In this case, the malicious packages were not slipped in through a novel exploit in npm itself, but...