The Hidden Blast Radius of the Axios Compromise
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
The Axios npm supply chain attack (malicious version 1.14.1) had a much larger blast radius than initially apparent. While teams focused on checking lockfiles and node_modules, the real risk came from time-dependent dependency resolution: any tool using a semver range like ^1.x.x that performed a fresh install during the
Table of contents
The Part That’s Easy to Understand #The Part That’s Not #This Was Not Isolated to One Package #Additional Exposure From MCP Tooling #Exposure Across Widely Used Production SDKs #Why the Blast Radius Is Larger Than It Looks #The Hardest Part of Figuring Out If You Were Affected #The Core Problem: Time-Dependent Dependency Resolution #What Actually Helps (and What Doesn’t Fully Solve It) #How to De-Risk Run Time Dependency Resolution #Where Install-Time Controls Fit #Sort: