Axios supply-chain attack: how to protect yourself

Originally published on LinkedIn.

Axios, JavaScript’s most widely used HTTP library with more than 100 million weekly downloads, suffered a supply-chain attack. An attacker compromised the lead maintainer’s npm account, published two poisoned releases (1.14.1 and 0.30.4), and injected a fake dependency.

The dependency installed a cross-platform RAT capable of stealing credentials, SSH tokens, CI/CD secrets, and other sensitive information.

How to protect yourself

One configuration with no trade-offs would have blocked this attack:

# ~/.npmrc
ignore-scripts=true

This prevents any package from running arbitrary code during installation, which is exactly the vector used in this case.

If you use Bun, you are already protected by default: it blocks lifecycle scripts from untrusted packages without any additional configuration.

Proactive detection

Socket adds another layer of protection. It analyzes every package before installation and detects suspicious behavior in real time.

Another configuration also adds protection, although with a trade-off:

# npm
min-release-age=7

# uv
exclude-newer = "7 days"

Both options block packages published less than a specified number of days ago. They reduce exposure to newly compromised releases, but they also delay urgent security patches.

That same week, the LiteLLM package was compromised on PyPI in versions 1.82.7 and 1.82.8, stealing credentials and other sensitive information. In Python, this age limit is especially useful because, unlike npm, there are no lifecycle scripts we can block.