Linus Tech Tips Discussion

 NPM Axios Massive Supply chain attack   Summary A large scale supply chain attack has targeted the developer of AXIOS, A critical back end dependency for web development.    Quotes Quote "Its sole purpose is to execute a postinstall script that acts as a cross-platform remote access trojan (RAT) dropper, targeting macOS, Windows, and Linux," security researcher Ashish Kurmi said. "The dropper contacts a live command and control server and delivers platform-specific second-stage payloads. After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection."   My thoughts  This is another back end attack meant to target a much wider scale. It is making basic development much more difficult not knowing if the oss dependency packages are compromised forcing developers to either take the risk or spend a lot more time and money writing the code themselves.  discussion question: in the age of ai and vibe coding how much more difficult do things like this make it to maintain security? Can normal people trust the services they use very day?    Sources https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html https://cybernews.com/security/axios-npm-critical-supply-chain-compromise/ https://www.securityweek.com/axios-npm-package-breached-in-north-korean-supply-chain-attack/