the WORST hack of 2026

The Axios npm package (100M+ weekly downloads) was compromised in a sophisticated supply chain attack. A hacker obtained the lead maintainer's npm access token, then added a malicious dependency (plain-crypto.js) to package.json rather than modifying Axios source code directly. This dependency's postinstall script deployed a remote access Trojan (RAT) in 1.1 seconds, then erased all traces of itself. Two release branches (1.14.1 and 0.30.4) were poisoned within 39 minutes of each other, meaning any project using caret ranges would automatically pull the compromised version. The post walks through how the attack worked, how to check if your system is affected, and remediation steps including rotating all credentials if compromised.