how i defeated the axios supply chain attack with a cron job

you won’t let those robots defeat me

— the flaming lips, yoshimi battles the pink robots, pt. 1

on 31 march 2026 two versions of axios went out that were not its maintainer’s, 1.14.1 and 0.30.4. the code was untouched; one line in package.json added a dependency, and that package was a remote access trojan with a postinstall hook. install axios, and it ran.

the versions were live for about three hours, which is a lot of machines, most of them belonging to people who would never hear about it.

so, a cron job. the trick is where it looks. nobody can scan the world’s node_modules, but anyone who installed the bad axios and committed a lockfile committed its name, plain-crypto-js, and github indexes committed files. one code search over lockfiles returns every repository that could have been hit and left the evidence in git: an upper bound on the damage, found by one query, with no access to anyone’s machine. the job runs the search on a schedule, pages through the results as github’s rate limit allows, remembers the repositories it has already told, and opens one issue in each new one: heads up, this is in your lockfile; here is the clean version to pin, how to regenerate the lockfile, where the trojan hides on mac, windows and linux, and when to stop cleaning and rebuild the machine.

it opened its first issue on the day of the attack and has opened one thousand five hundred and fifty-eight since.

sources: the stack on the compromise and ox security on the dependency.