Sup hackers.
The supply chain is on fire again.
On March 31, 2026, a threat actor hijacked the npm account of the lead axios maintainer and published two malicious versions of one of the most popular JavaScript libraries in existence.
The attacker compromised the npm account of jasonsaayman and used a long-lived classic npm access token to publish poisoned versions directly to the registry. The crazy part is the maintainer said publicly he had MFA on practically everything. The exact method of token compromise is still undetermined.
In this attack, when a developer runs npm install, npm resolves the axios dependency tree and installs [email protected] automatically, which executes its postinstall script, launching a dropper that contacts a command-and-control server and delivers separate second-stage payloads for macOS, Windows, and Linux. The dropper then erases itself and replaces its own package.json with a clean decoy, leaving a developer who inspects their node_modules folder after the fact with no indication anything went wrong.
The malicious versions were live for approximately two hours and 53 minutes.
This attack may be part of the broader TeamPCP supply chain campaign, which between March 19 and March 27 compromised four widely used open-source projects in rapid succession: the Trivy vulnerability scanner, the KICS infrastructure-as-code scanner, and the LiteLLM AI proxy library on PyPI.
The world's a crazy place.
Stay sharp out there.
Happy hacking, Low Level
P.S., in the era of AI everything, learning the fundamentals of how computers work is more important than ever. The best way to do that and stand out from the crowd is learning to code in C. check out my course for more info.