🚨 NPM axios Supply Chain Attack 🚨

A late-night impromptu stream evolved into live coverage of a critical supply chain attack on the Axios HTTP client library, where compromised maintainer credentials pushed malicious packages delivering cross-platform remote access Trojans to hundreds of thousands of users 1:23-1:51.

Key Takeaways:
• The creator resolved initial audio issues before pivoting to cover the breaking Axios compromise 1:23
• The "sleepy stream" moniker reflected the late-hour, impromptu nature of the coverage 1:44
• A virtual machine was configured for safe live malware analysis during the stream 2:04
• The creator immediately recognized the Axios incident as a significant event worth covering live 2:19

The attack leveraged stolen credentials rather than a code vulnerability, injecting malicious dependency plain-crypto-js 4.2.1 into Axios versions 1.14.1 and 0.30.4—resulting in over 500,000 malicious installs before maintainers deprecated the packages within roughly two hours.

Sources:

• 1:23 Creator discovers they've been muted
• 1:44 Describing the stream as "sleepy" due to late timing
• 2:04 Setting up virtual machine for screen sharing
• 2:19 Mentioning current events to discuss