On March 30, 2026, a threat actor compromised the official Axios npm package, one of the most depended-upon libraries in JavaScript with more than 100 million weekly downloads. Two poisoned versions were published within a 39-minute window, and both the latest and the legacy distribution tags were hijacked, so an install that pinned to either tag got the payload. The payload was a cross-platform remote access trojan that ran on Windows, macOS and Linux.
Why it hits agents harder
A human developer running npm install had a small chance of noticing. An AI coding agent had none. Agents resolve dependencies, run installs and continue to the next step as a single motion, and the research published this year on agent behavior found that they skip package verification as a matter of course. ReversingLabs documented a North Korean campaign, PromptMink, that engineered npm packages specifically to fool agents. Phoenix Security's mid-year report counted the first half of 2026 at more than 2.6 times the campaign volume and 4.5 times the package compromise volume of all of 2025.
SafeDep's note on the campaign that followed in May drew the line directly: the axios compromise targeted one high-value package; Mini Shai-Hulud cast a wide net across hundreds. Same root cause, a compromised publishing credential.
What to do
- 01Pin versions and enforce a cooldown of at least 24 hours on new publishes in CI. The window was 39 minutes.
- 02Give every runner and every developer machine that runs a coding agent a resolver policy: registries and the repository host allowed, everything first-seen held.
- 03Alert on any first-seen resolution from a build host. Build hosts have no reason to discover new destinations mid-pipeline.
- 04Restrict raw-IP egress from build networks at the firewall; the resolver cannot see a connection with no name.