--- title: Axios supply chain attack confirmed, JavaScript... description: A roundup covering several major JavaScript ecosystem developments: the Axios npm package was compromised on March 31st by a North Korean threat actor via a... canonical: https://daily.dev/posts/axios-supply-chain-attack-confirmed-javascript-ecosystem-state-of-play-in-2026-3xu5oyziq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Axios supply chain attack confirmed, JavaScript ecosystem state of play in 2026 | daily.dev og:description: A roundup covering several major JavaScript ecosystem developments: the Axios npm package was compromised on March 31st by a North Korean threat actor via a... og:url: https://daily.dev/posts/axios-supply-chain-attack-confirmed-javascript-ecosystem-state-of-play-in-2026-3xu5oyziq og:image: https://api.daily.dev/og/posts/3xU5oyziq.png og:image:alt: Axios supply chain attack confirmed, JavaScript ecosystem state of play in 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Axios supply chain attack confirmed, JavaScript ecosystem state of play in 2026 **[Web Digest](https://daily.dev/sources/webdev_digest)** · 4 min read · 0 upvotes · 0 comments ## Summary A roundup covering several major JavaScript ecosystem developments: the Axios npm package was compromised on March 31st by a North Korean threat actor via a hijacked maintainer account, injecting a remote access Trojan targeting AWS keys and credentials — anyone who ran npm install that day should revoke all secrets and pin dependencies. A 2026 JS ecosystem overview highlights Bun's acquisition by Anthropic, Astro by Cloudflare, Remix going React-free, Next.js 16 with Turbopack, ES2026 features including the Temporal API, and TypeScript v7's Go-based compiler. Mantine 9 shipped with a large changelog, and Clerk raised its free tier to 50,000 users while bundling most auth add-ons into the base pro plan. Additional items cover CSS shape() function, CSS performance wins in Vaadin grids, signals internals, a PDF.js CVE, and new browser APIs replacing common JS libraries. ## Content **TLDR:** The Axios npm package was compromised on March 31st via a hijacked maintainer account, and anyone who ran `npm install` during that window should treat their machine as fully compromised. Separately, a solid 2026 JavaScript ecosystem overview landed on the Frontend Masters blog covering everything from ES2026 features to Bun's acquisition by Anthropic. Mantine 9 shipped with a massive changelog, and Clerk raised its free tier to 50,000 users while bundling most auth add-ons into the base pro plan. --- ## Axios npm package compromised in supply chain attack Two Axios versions (1.14.1 and 0.30.4) were pushed by a North Korean threat actor (UNC1069) after they compromised the lead maintainer's account. The malicious packages included a poisoned transitive dependency — `plain-crypto-js@4.2.1`, a typosquat of `crypto-js` — that installed a remote access Trojan targeting AWS keys, GitHub tokens, and database credentials. Socket's scanner caught it within six minutes, but projects using unpinned caret ranges pulled it in silently. If you ran `npm install` on March 31st, revoke everything. Going forward: pin your dependencies, set `ignore-scripts=true` in `.npmrc`, and seriously consider whether you need Axios at all when `fetch` exists. ## JavaScript ecosystem in 2026: what actually matters The Frontend Masters blog published a thorough state-of-JS overview worth bookmarking. The headline items: Bun was acquired by Anthropic, Astro was acquired by Cloudflare, Remix is going React-free, and Next.js 16 ships with Turbopack as the default bundler. On the language side, ES2026 brings the Temporal API, Iterator Helpers, `RegExp.escape`, and explicit resource management. TypeScript v6 is current; v7 will use a Go-based compiler. The npm supply chain section is particularly relevant given the Axios incident above. ## Mantine 9 released Mantine 9 dropped with a large changelog. The maintainer continues to ship at a pace that puts most open source projects to shame, and notably still hasn't adopted Tailwind CSS — which, depending on your setup, is either a feature or a footnote. Worth checking the changelog if you're already using it; worth evaluating if you're not. ## Clerk raises free tier, bundles add-ons Clerk Core 3 ships alongside a pricing overhaul: the free tier jumps from 10,000 to 50,000 retained users, and all paid plans now include unlimited applications. Most auth add-ons are bundled into the pro plan, with only billing, B2B, and admin features remaining separate. Core 3 also adds proper support for React transitions, Suspense, and streaming, including Next.js 16's cache component. Automated migration to the new pricing is scheduled for April. --- ## Also notable - **CSS `shape()` function:** A deep-dive on creating organic blob shapes, wavy dividers, and animated liquid effects entirely in CSS without SVG — including scroll-driven animation support via `animation-timeline: scroll()`. - **Three CSS reset additions:** `min-block-size: 100svh` for footer positioning, `scrollbar-gutter: stable` to prevent layout shift on scroll, and `interpolate-size: allow-keywords` for smooth transitions to intrinsic sizes like `auto` and `fit-content`. - **Vaadin CSS grid performance:** Replacing box shadows with borders cut render time ~50%; switching from attribute selectors to class selectors dropped scrolling frame time from 90ms to 40ms; registering `light-dark()` custom properties via `@property` cut Aura theme render time ~60%. A 180-column grid went from ~7.2s initial render to ~1s. - **Signals internals:** A solid walkthrough of the push-pull algorithm behind fine-grained reactivity in Solid, Vue, Preact, and Angular, including a from-scratch implementation and notes on the TC39 standardization proposal. - **CVE-2024-4367 in PDF.js:** A CVSS 8.8 flaw allowing arbitrary JS execution via malformed FontMatrix values in PDF font definitions — affects versions prior to 4.2.67. If you're rendering PDFs in-browser, upgrade or set `isEvalSupported: false`. - **`view-transitions-toolkit` on npm:** A new utility package from the Chrome team with helpers for feature detection, playback control (pause/resume/scrub), and automatic transition type injection based on navigation. - **Pretext library:** A new JS library from React core contributor Cheng Lou that calculates paragraph text height without touching the DOM, using off-screen canvas measurement and browser word-wrap emulation. Handles CJK, Arabic, and RTL scripts. - **Browser APIs replacing libraries:** A PodRocket episode with Kilian Valkhof making the case for `Intl` over date-fns/Moment, plus `dialog`, popovers, anchor positioning, and view transitions as native replacements for common JS-heavy patterns. - **SolidStart 2.0 stream announced:** Ryan Carniato is bringing the team together for a stream covering the upcoming SolidStart 2.0 release. - **`@wordpress/build`:** A new WordPress plugin build tool replacing webpack/Babel with esbuild, already powering all 100+ Gutenberg packages, with zero-config convention-based discovery and auto-generated PHP registration files. - **mobx-vue and mobx-vue-lite:** Both libraries appear unmaintained — worth factoring in if you're evaluating MobX for a Vue project. --- Tags: [#security](https://daily.dev/tags/security), [#webdev](https://daily.dev/tags/webdev), [#javascript](https://daily.dev/tags/javascript), [#typescript](https://daily.dev/tags/typescript), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/axios-supply-chain-attack-confirmed-javascript-ecosystem-state-of-play-in-2026-3xu5oyziq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/axios-supply-chain-attack-confirmed-javascript-ecosystem-state-of-play-in-2026-3xu5oyziq","headline":"Axios supply chain attack confirmed, JavaScript ecosystem state of play in 2026","text":"A roundup covering several major JavaScript ecosystem developments: the Axios npm package was compromised on March 31st by a North Korean threat actor via a hijacked maintainer account, injecting a remote access Trojan targeting AWS keys and credentials — anyone who ran npm install that day should revoke all secrets and pin dependencies. A 2026 JS ecosystem overview highlights Bun's acquisition by Anthropic, Astro by Cloudflare, Remix going React-free, Next.js 16 with Turbopack, ES2026 features including the Temporal API, and TypeScript v7's Go-based compiler. Mantine 9 shipped with a large changelog, and Clerk raised its free tier to 50,000 users while bundling most auth add-ons into the base pro plan. Additional items cover CSS shape() function, CSS performance wins in Vaadin grids, signals internals, a PDF.js CVE, and new browser APIs replacing common JS libraries.","url":"https://daily.dev/posts/axios-supply-chain-attack-confirmed-javascript-ecosystem-state-of-play-in-2026-3xu5oyziq","datePublished":"2026-04-03T04:17:49.775Z","dateModified":"2026-04-03T04:18:10.982Z","author":{"@type":"Organization","name":"Web Digest","logo":"https://media.daily.dev/image/upload/s--C833eNQW--/f_auto,q_auto/v1773839396/logos/webdev_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/webdev_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/webdev_digest","name":"Web Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Web Digest","item":"https://daily.dev/sources/webdev_digest"},{"@type":"ListItem","position":3,"name":"Axios supply chain attack confirmed, JavaScript ecosystem state of play in 2026"}]} ```