Christian Alder17h ago

So I guess I have some learning to do about this recent supply chain attack and npm stuff 👀

No recent project I'm working on has Axios as a dependency, these in the screenshot are old. But it's time I understood a bit more on how to stay safe. Open to any wisdom!

Found this article regarding the incident

https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/

So from the sounds of it, had I been doing an npm install within that two hour window I could have been affected? just like that? That's scary.

Show threadAmadeus Maximilian16h ago

@hejchristian Yeah, and the biggest issue are transitive dependencies. Just because you didn’t install Axios explicitly, doesn’t mean another package you installed couldn’t have it in its dependencies. So you might be screwed without even knowing it. 😅

The fewer dependencies, the better. A lot of what many packages do can be done rather trivially by yourself or using modern APIs (like Fetch in this case).

If you can, you could also use the --no-scripts flag, however that might not always work.

Show threadAmadeus Maximilian16h ago

@hejchristian Dang it, it’s actually the --ignore-scripts flag, but the previous post doesn’t have enough space for the extra characters, so I can’t edit it.

Anyway, with room to elaborate: there’s deps that rely on scripts running pre or post installation. So ignoring them doesn’t always work. What I try to do is keep myself informed about the supply chain attacks and doing due dilligence when choosing deps in the first place, ie ensuring they have as few dependencies as possible of their own.

Show threadChristian Alder15h ago

@amxmln Thanks for the wisdom!

The axios I have here, I didn't explicitly install, they were dependencies.

They're all in 11ty projects though I'm not sure even that's the link - perhaps a plugin I kept using? I'll need to do some digging to understand what was bringing it in.

Axios aside, it's the steps I should take to harden myself against future issues that I need to focus on for sure.

https://www.herodevs.com/blog-posts/the-axios-compromise-what-happened-what-it-means-and-what-you-should-do-right-now#:~:text=If%20You%27re%20Not%20Affected%3A%20Harden%20Anyway

So --ignore-scripts, lockfiles, and pinned deps?

HeroDevs Blog | The Axios Compromise: What Happened, What It Means, and What You Should Do Right Now

On March 31, 2026, malicious versions of axios were published to npm through a hijacked maintainer account, delivering a cross-platform RAT to anyone who ran npm install during a three-hour window. Here's exactly what happened, how to check your exposure, and what to harden before the next one.

Show threadAmadeus Maximilian

@hejchristian Yeah pretty much, as well as generally really asking yourself whether you need to install something or not in the first place. 😊

What I also tend to do, at least for my direct dependencies is to check their GitHub repos before installing / upgrading, even for patch updates. If the release in npm doesn’t match the changelog / GitHub releases, I get wary.

8:11pmWeb
Show threadChristian Alder15h ago

@amxmln

I never felt I've gone overboard getting packages, but the dependencies to what few things I do end up getting, that's where I gets a bit messy.

I tried to do some digging and found for one project I had an old 11ty (1.0.2), where axios had been a non-direct dep

https://npmx.dev/package/@11ty/eleventy/v/1.0.2 , due to browser-sync (back then)

just the idea that running npm install at the wrong time could introduce such a thing is a worry - but I'll for sure try to stay more vigilant about it all, thanks 🙏

Show threadAmadeus Maximilian15h ago

@hejchristian Yeah that’s the whole issue though, you think you’re getting just a couple packages, but they end up installing half the registry. 😅

I feel like these days, installing something always feels like a bit of a coin toss, sadly. And the direction Microsoft has been going makes me worry admit the entire JS ecosystem.

Sadly, none of us have the time to build everything from scratch. 😅

Show threadChristian Alder15h ago

@amxmln aha yeah 😅 Going to just be slow and steady when it comes to adding new stuff or even updating.

I used to think I should update on the regular but maybe that's not the right approach (for NPM anyway) 🤷 Update at the wrong time and bam, here's a trojan as a treat lol.

Show threadAmadeus Maximilian15h ago

@hejchristian Haha yeah I know that feeling. 😅 I do still update pretty regularly, but yeah, we’ve gut to be careful.

Some people have suggested running each project in its own container, which I guess would minimise threats, but also sounds like it might add a lot of friction.

Show threadAmadeus Maximilian15h ago
@hejchristian Oh and by the way, you can use npm list [dependency] to find out which package it was installed from. 😊
Show threadChristian Alder15h ago
@amxmln Awesome tip, thanks :)