The night the Axios package was compromised

The night the Axios package was compromised

On a night in March 2026, a security alert surfaced: a malicious version of Axios, one of the most widely used JavaScript libraries for HTTP requests, had been published to npm. Any project that installed that version could be compromised.

Almost every JavaScript project we had used Axios, so I didn't wait for the morning. I raised the alert with the team and my manager the same night it surfaced.

My manager then asked me and our DevOps engineer to check everything. Together we audited every company project and every server to find out which ones could have pulled in the compromised version.

Supply-chain attacks don't announce themselves inside your own code. Catching this one early depended on someone following the ecosystem closely and acting on it right away.