--- title: the WORST hack of 2026 | daily.dev description: The Axios npm package (100M+ weekly downloads) was compromised in a sophisticated supply chain attack. A hacker obtained the lead maintainer's npm access... canonical: https://daily.dev/posts/the-worst-hack-of-2026-njhyaeyo6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: the WORST hack of 2026 | daily.dev og:description: The Axios npm package (100M+ weekly downloads) was compromised in a sophisticated supply chain attack. A hacker obtained the lead maintainer's npm access... og:url: https://daily.dev/posts/the-worst-hack-of-2026-njhyaeyo6 og:image: https://api.daily.dev/og/posts/NJHyaeyo6.png og:image:alt: the WORST hack of 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # the WORST hack of 2026 **[NetworkChuck](https://daily.dev/sources/networkchuck)** · 11 min read · 0 upvotes · 0 comments ## Summary The Axios npm package (100M+ weekly downloads) was compromised in a sophisticated supply chain attack. A hacker obtained the lead maintainer's npm access token, then added a malicious dependency (plain-crypto.js) to package.json rather than modifying Axios source code directly. This dependency's postinstall script deployed a remote access Trojan (RAT) in 1.1 seconds, then erased all traces of itself. Two release branches (1.14.1 and 0.30.4) were poisoned within 39 minutes of each other, meaning any project using caret ranges would automatically pull the compromised version. The post walks through how the attack worked, how to check if your system is affected, and remediation steps including rotating all credentials if compromised. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Supply Chain Attack Impacts Widely Used Axios npm Package](https://daily.dev/posts/supply-chain-attack-impacts-widely-used-axios-npm-package-e3anajjqf) · Arctic Wolf · 0 upvotes · 0 comments - [Axios npm Package Compromised in Supply Chain Attack](https://daily.dev/posts/axios-npm-package-compromised-in-supply-chain-attack-yteqa7dzf) · InfoQ · 0 upvotes · 0 comments - [Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT](https://daily.dev/posts/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform-rat-fk3xmak18) · Snyk · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#javascript](https://daily.dev/tags/javascript), [#npm](https://daily.dev/tags/npm), [#axios](https://daily.dev/tags/axios) [View this post on daily.dev](https://daily.dev/posts/the-worst-hack-of-2026-njhyaeyo6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"the WORST hack of 2026","url":"https://daily.dev/posts/the-worst-hack-of-2026-njhyaeyo6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-worst-hack-of-2026-njhyaeyo6"},"datePublished":"2026-03-31T15:00:57.335Z","dateModified":"2026-03-31T15:01:22.732Z","description":"The Axios npm package (100M+ weekly downloads) was compromised in a sophisticated supply chain attack. A hacker obtained the lead maintainer's npm access...","image":"https://i.ytimg.com/vi/eGSsoSEppNU/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/eGSsoSEppNU/sddefault.jpg","isAccessibleForFree":true,"articleSection":"NetworkChuck","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"NetworkChuck","logo":"https://media.daily.dev/image/upload/s--tgEVJvQC--/f_auto/v1729363472/logos/networkchuck","url":"https://daily.dev/sources/networkchuck"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-worst-hack-of-2026-njhyaeyo6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,javascript,npm,axios","timeRequired":"PT11M","video":{"@type":"VideoObject","name":"the WORST hack of 2026","description":"The Axios npm package (100M+ weekly downloads) was compromised in a sophisticated supply chain attack. A hacker obtained the lead maintainer's npm access...","thumbnailUrl":"https://i.ytimg.com/vi/eGSsoSEppNU/sddefault.jpg","uploadDate":"2026-03-31T15:00:57.335Z","duration":"PT11M","url":"https://api.daily.dev/r/NJHyaeyo6","embedUrl":"https://www.youtube.com/embed/eGSsoSEppNU"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"NetworkChuck","item":"https://daily.dev/sources/networkchuck"},{"@type":"ListItem","position":3,"name":"the WORST hack of 2026"}]} ```