Me meeting up with my insiders for status updates on recent supply chain attacks.

🚨‼️ MAJOR SUPPLY CHAIN ATTACK: npm package axios is compromised after the maintainer's npm account was hijacked.

Malicious versions contain a Remote Access Trojan. axios has 100M+ weekly downloads — it's in practically everything.

If you have installed axios@1.14.1 or axios@0.30.4, assume compromise.

Axios' lead maintainer jasonsaayman's npm account was compromised — email was swapped to an anonymous Proton Mail address.

Both malicious versions were pushed manually via npm CLI, bypassing GitHub Actions OIDC entirely, without commits.

🔴 Stepsecurity report: https://stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan

🔴 Socket report:
https://socket.dev/blog/axios-npm-package-compromised

🚨‼️ BREAKING: Claude Code's source code has been leaked via a map file exposed in Anthropic's npm registry.

The leaked code appears to reveal new and previously undisclosed features.

Source code backups:

1)
https://github.com/chatgptprojects/claude-code

2)
https://pub-aea8527898604c1bbb12468b1581d95e.r2.dev/src.zip

‼️ Meet the guy almost everyone loves for alerting the axios devs about the supply chain attack.

He built a supply chain monitoring system last week, and was alerted within minutes of the axios compromise.

The world should be thanking Elastic Security's finest:
Joe
X:dez_

‼️ Tomorrow we're dropping a TeamPCP supply chain attack victim list, including verification status and more.

Got tips? DM us or use our Signal (see bio).

❤️ rodents.