🧰 axios

The items that name it 40

• Software supply chain security best practices for 2026
  articleas classification.technologies2026-10-21
• Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain
  paperas classification.key entities2026-10-20
• Supply Chain Zero Days: Closing the Gap Between Publication and Detection
  articleas classification.key entities2026-10-19
• New research: malware in open source ecosystems surges 14x as attackers hijack trusted packages | Endor Labs
  articleas affected products2026-10-12
• Evolution of Web3 in Cloud Supply Chain Attacks
  articleas affected products2026-10-07It is written here as axios (npm; lead maintainer compromised, plain-crypto-js injected).

  npm; lead maintainer compromised, plain-crypto-js injected

• Derek Abdine (@dabdine) on X
  threadas classification.key entities2026-10-07
• Socket: Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
  writeupas tools2026-09-20

  HTTP client installed by the payloads/bootstraps into their working directory when dependencies are missing, used for network requests.

• The State of Cloud Risk 2026: Most Security Findings Aren’t Real Attacker Opportunities
  articleas affected products2026-08-26

  affected by related DPRK supply chain attack

• Shai-Hulud was the best thing to happen to supply chain security
  articleas affected products2026-08-24

  100M+ weekly downloads; two backdoored versions published 39 minutes apart by Sapphire Sleet, Mar 31, 2026; had not adopted Trusted Publishing before compromise

• The State of Open Source Supply Chain Attacks
  articleas affected products2026-08-23

  Package with over 100 million weekly downloads; malicious versions axios@1.14.1 and axios@0.30.4 pulled in a fake dependency dropping a cross-platform RAT, August 2026.

• The OpenSourceMalware Show #18
  talkas classification.key entities2026-08-21
• Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
  writeupas classification.key entities2026-08-20
• Socket: How AI Agents Expand the Software Supply Chain Attack Surface
  talkas affected products2026-08-17

  supply chain attack incident referenced

• Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List.
  articleas classification.technologies2026-08-15
• Control Which Package Registries Your CI Jobs and Developer Machines Use
  articleas affected products2026-08-12

  HTTP client package on npm, malicious versions published

• Cloud Threat Highlights: H1 2026
  writeupas affected products2026-08-06

  npm package trojanized by North Korea's Midnight Neptune in late March 2026.

• Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era
  articleas affected products2026-08-03

  Package downloaded 100 million times per week; backdoored via compromised maintainer account

• The upgrade trap: when upgrading is the wrong answer to a CVE
  articleas classification.technologies2026-07-22
• OpenSourceMalware Blog
  articleas affected products2026-07-18It is written here as Axios (npm package).

  Compromised; maintainer locked out of account; three malicious npm packages linked to the March Axios compromise harvested developer credentials since early April.

• What is a dependency firewall?
  articleas affected products2026-07-13

  npm library used across ~100 million weekly downloads; maintainer npm account hijacked in March 2026, two malicious versions pushed

• JFrog: Where CVE Severity Scores Go Wrong
  writeupas affected products2026-07-01

  Popular JavaScript HTTP client; since April 2026 released advisories for 10 CVEs, all requiring a pre-existing prototype pollution vulnerability in the JavaScript process introduced via a separate dependency.

• npm now freezes high-impact accounts after risky account changes
  articleas affected products2026-06-26

  npm package with about 100 million downloads a week; compromised in March when attacker changed account email and published two malicious versions directly, avoiding CI.

• Thinkst Package Proxy
  toolas affected products2026-06-26

  Package involved in a breach where package integrity regressed due to a changed upload mechanism, alerting developers to supply chain attack sophistication

• The OpenSourceMalware Show #9
  talkas classification.key entities2026-06-18
• Socket: Introducing Manifest Alerts
  articleas affected products2026-06-18

  compromised package at the center of the incident referenced

• Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files
  articleas affected products2026-06-18

  prior supply chain compromise StepSecurity was officially credited for discovering (mentioned as past track record)

• Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier
  writeupas affected products2026-06-18It is written here as axios (npm package).

  Earlier 2026 npm supply-chain compromise attributed by Microsoft to Lazarus Group; shares tradecraft with Mastra compromise but did not target browser extensions

• Over 140 popular Mastra npm Packages Hit by Supply Chain Attack
  writeupas classification.technologies2026-06-17
• npm v12 delivers one of the biggest security improvements in years
  articleas affected products2026-06-11

  ~100 million downloads a week; postinstall hook dropped a cross-platform RAT.

• Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter
  writeupas affected products2026-06-09It is written here as axios (npm).

  Affected by a related npm supply chain attack referenced as part of the Shai-Hulud campaign timeline.

• The OpenSourceMalware Show #7
  talkas classification.key entities2026-06-03
• The Software Supply Chain Malware Landscape: January - May 2026
  articleas affected products2026-06-03

  npm package compromised in one of the biggest ATOs this year; averages 108.4 million weekly downloads; attacker unknown.

• Why EDR and proxy won’t save you from supply chain malware
  articleas affected products2026-06-02

  npm package with ~100M weekly downloads; maintainer's npm account hijacked in March 2026

• What MDM can't protect on developer machines (and what to do about it)
  articleas classification.key entities2026-05-28
• VSCode Lifecycle Script Malware
  writeupas affected products2026-05-16
• Cooldowns.dev
  articleas affected products2026-05-06It is written here as axios (npm).

  npm

• Tradecraft Tuesday Recap: axios npm Supply Chain Compromise
  articleas affected products2026-04-21It is written here as axios (npm package).

  Widely used JavaScript library (~100 million weekly downloads) backdoored after threat actor gained access to maintainer jasonsaayman's npm account; two malicious versions removed within three hours

• Supply Chain Compromise of axios npm Package
  writeupas affected products2026-03-31It is written here as axios (npm package).

  Backdoored releases published by attacker after compromising maintainer jasonsaayman's npm account

• SubQuery npm package (@subql/common) compromised with credential-stealing payload
  articleas affected productsIt is written here as axios (npm package).

  npm package compromise reported earlier in the year by StepSecurity.

• 973 MCP Packages, 71% Single-Maintainer: A Practitioner
  articleas classification.technologies