Your Node.js App Is Lying to You: What axios Taught Us

On 31 March 2026, axios, a package downloaded 100 million times a week, quietly turned into a malware delivery system for about three hours. Every project that ran npm install in that window was silently backdoored. The worst part? Afterwards the package looked clean. npm audit found nothing. Your app told you everything was fine.

This is a practical tour of Node.js supply chain security in 2026. We will trace how real attacks work, from typosquatting and dependency confusion to account takeovers and poisoned build pipelines, and find the thread running through all of them: almost none exploited a clever bug. They exploited trust.

Then the uncomfortable part. The tools you rely on give false confidence. npm audit only knows what is already flagged. Lockfiles only pin what you already trusted. axios is the clearest proof, because the malicious code wiped its own tracks and left a clean manifest behind.

The second half is a defence playbook you can apply the same week: disabling install scripts, reviewing dependency diffs, verifying provenance with sigstore, and locking down CI so one stolen token cannot publish in your name, which is exactly how axios happened. The timing matters. npm v12 makes install scripts opt-in by default from July 2026, the biggest change to npm install in over a decade. We will cover what it fixes, what it misses, and why a compromised package you already trust walks straight through an allowlist.

The npm registry is shared infrastructure. An attack on one corner reaches all of us, wherever we ship from. This talk is offered in that spirit: international incident experience brought to a problem every Node.js developer shares.