how i defeated the axios supply chain attack with a cron job

you won’t let those robots defeat me

— the flaming lips, yoshimi battles the pink robots, pt. 1

on 31 march 2026, two versions of axios shipped that its maintainer never wrote: 1.14.1 and 0.30.4.

the trick was that a maintainer’s account got hacked, and whoever got in added 1 line to package.json: one new dependency. that dependency was a remote access trojan with a postinstall hook. so the whole attack was: you type npm install axios, you press enter, and your machine belongs to someone else now.

in the developer sphere, these are called supply chain attacks.

this particular supply chain attack was live for, say, 3 hours. which doesn’t sound like much, but unfortunately axios is one of the most downloaded packages on earth. 3 hours of axios is tens of thousands of installs. and the people pulling it in those hours just aren’t the seasoned ilk. professionals tend not to reach for axios any more. students do. and students never heard about this at all. so now the world was spiralling out of control as kajillions of teenagers trying to get into coding were getting their lunch money stolen.

read the datadog write-up. it’s brutal. this thing went after your credit card details, your api keys, your passwords. your mom’s phone number, probably. anything on the disk it could carry out the door. so you can visualise scammers running for the hills with bags full of pictures of your high school crush.

nobody can scan the world’s node_modules. but anyone who installed the bad axios and committed a lockfile committed its name, plain-crypto-js, and github indexes committed files. so i wrote a cron job that does a code search every day over lockfiles, for every repository that could have been hit and left the evidence in git. then, if you’re a victim, it screams at you.

it opened its first issue on the day of the attack and has opened one thousand five hundred and fifty-eight since. and that’s how i continue to police the world from sophisticated malware. saving children alike from the evil machines ran by the evil people. with a cron job.

sources: datadog security labs on what the trojan does, the stack on the compromise and ox security on the dependency.