do you understand what just happened to one of the most used npm packages on the internet?
→ axios gets downloaded over 100 million times a week and today it got compromised
→ an attacker hijacked the npm credentials of a lead axios maintainer… changed the account email to an anonymous ProtonMail address… and manually published two poisoned versions
→ axios@1.14.1 and axios@0.30.4… neither version contains a single line of malicious code inside axios itself. instead they inject a fake dependency called plain-crypto-js that drops a remote access trojan on your machine
→ the fake dependency was staged 18 hours in advance… three separate payloads were pre-built for macOS, Windows, and Linux… both release branches were hit within 39 minutes. every trace was designed to self-destruct after execution too
→ there’s no tag in the axios GitHub repo for 1.14.1. it was published outside the normal release process entirely... bypassed CI/CD completely
→ StepSecurity called it one of the most operationally sophisticated supply chain attacks ever against a top 10 npm package
→ a routine npm install silently opens a backdoor… no warning… no suspicious code visible in axios itself
this is the wake up call all vibe coding bros need to hear right now:
→ if you installed either version… assume your system is compromised
→ pin to axios@1.14.0 or axios@0.30.3
→ rotate all secrets, API keys, SSH keys, and credentials on affected machines
→ check network logs for C2 connections
→ add –ignore-scripts to CI npm installs going forward
100 million weekly downloads and one compromised maintainer account…
that’s all it took to wreak absolute havoc
and I imagine we see a whole lot more of these… crazy times ahead for cybersecurity and vibe coding
be safe out there y’all

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios

Feross

Twitter

你明白互聯網上最常用的 npm 包之一發生了什麼嗎？

→ axios 每週下載量超過 1 億次，今天它被攻破了。

→ 攻擊者劫持了 axios 主要維護者的 npm 賬號密碼……將賬號郵箱更改為匿名 ProtonMail 地址……並手動發佈了兩個惡意版本。

→ axios@1.14.1 和 axios@0.30.4……這兩個版本本身都沒有包含任何惡意代碼。攻擊者注入了一個名為 plain-crypto-js 的虛假依賴項，該依賴項會在你的機器上植入遠程訪問木馬。

→ 這個虛假依賴項提前 18 小時準備就緒……攻擊者預先構建了適用於 macOS、Windows 和 Linux 的三個獨立有效載荷……兩個發佈分支都在 39 分鐘內遭到攻擊。所有痕跡都設計為在執行後自動銷燬。

→ axios GitHub 倉庫中沒有 1.14.1 版本的標籤。它完全繞過了正常的發佈流程……徹底繞過了 CI/CD

→ StepSecurity 稱其為有史以來針對排名前十的 npm 包發起的最具操作複雜性的供應鏈攻擊之一

→ 一次例行的 npm install 操作悄無聲息地打開了一個後門……沒有任何警告……axios 本身也沒有任何可疑代碼

這是所有 Vibe Code 兄弟們現在需要聽到的警鐘：

→ 如果你安裝了這兩個版本中的任何一個……假設你的系統已被入侵

→ 鎖定到 axios@1.14.0 或 axios@0.30.3

→ 在受影響的機器上輪換所有密鑰、API 密鑰、SSH 密鑰和憑據

→ 檢查網絡日誌中是否存在 C2 連接

→ 今後在 CI npm install 中添加 --ignore-scripts 參數

每週 1 億次下載，一個維護者賬戶被盜……

這就是造成徹底破壞的全部所需

而且我估計我們會看到更多這樣的事件……網絡安全和 Vibe Code 的未來充滿挑戰

大家注意安全

XRP在幣安的30天流動性指數已下降歷史新低，接近於零。交易量也從2025年1月的超過2000億鎂下挫幾乎為零。
這...

XRP在幣安的流動性下挫——價格將如何反應？

原文標題：How Perplexity + Claude Replace an Entire Analyst Team on Polymarket
原文作者：@0xwhrrari
原文編譯：Peggy，BlockBeats
編者按：本文介紹了一種在 Polymarket 上識別套利機會並將其系統化執行的方法：用 Perplexity 完成研究，定位數據與市場定價之間的偏差；用 Claude 搭建交...

別憑感覺下注了：AI正在Polymarket上「撿錢」

Circle 能否從“吃利息的穩定幣公司”轉型為全球數字美元基礎設施？