I just came across a quite serious supply chain security incident. Axios, the most popular JavaScript HTTP client library, was attacked.

In simple terms, the attacker stole the access token of axios's lead maintainer on npm, then released two malicious packages containing remote access trojans (versions 1.14.1 and 0.3.4), targeting macOS, Windows, and Linux. These malicious versions remained on the npm registry for about 3 hours before being taken down.

Even more alarming is the scope of the impact. According to security firm Wiz, axios is downloaded over 100 million times weekly and is present in roughly 80% of cloud and code environments. This means the number of potentially affected systems could be quite large. Security company Huntress detected the first infections just 89 seconds after the malicious packages went live and confirmed at least 135 systems were compromised during the exposure window.

What’s most interesting is that the axios project had already implemented modern security measures like OIDC trusted publishing mechanisms and SLSA provenance proofs. Yet, the attacker still completely bypassed them. Investigations revealed the issue was due to misconfiguration — while enabling OIDC, the project still retained the traditional long-lived NPM_TOKEN, and npm defaults to prioritizing the old token when both are present. As a result, the attacker didn’t need to break through OIDC; they simply used the old token to publish successfully.

What does this incident tell us? No matter how new and robust the security mechanisms are, misconfiguration renders them useless. Axios’s case warns us that supply chain security isn’t just a technical challenge; execution details are equally critical. If your project or application depends on widely used open-source libraries, you might want to check your dependencies now.