How the [email protected] supply chain attack worked (and how to protect yourself)

On March 31, 2026, someone hijacked the npm account of axios's lead maintainer and published two malicious versions: [email protected] and [email protected]. Both contained a hidden dependency called plain-crypto-js whose postinstall script dropped a cross-platform RAT on every developer machine that ran npm install. The RAT harvested SSH keys, cloud tokens, AWS credentials, and anything else it could find. It was live on npm for over 12 hours before being pulled. Axios gets 40+ million weekly downloads. Here's how the attack worked, what the industry got wrong, and what you can do about it. The attack chain Step 1: Account takeover. The attacker changed the email on the user's npm account to an attacker-controlled ProtonMail address. npm did not require re-authentication for this change. Step 2: Pre-staging. 18 hours before the main attack, the attacker published [email protected] — a clean-looking package with no obvious malicious code. This gave it time to build a benign-looking publish h