Discussion of how the maintainer's npm account was hijacked despite 2FA requirements, with speculation about token theft or phishing
← Back to Axios compromised on NPM – Malicious versions drop remote access trojan
The recent hijacking of a lead axios maintainer's npm account underscores the inadequacy of traditional TOTP-based security against sophisticated phishing and token theft, especially when bypass tokens allow attackers to circumvent standard CI/CD pipelines. Commenters argue that this incident is part of a broader "chain of compromise" across major packages like Trivy and LiteLLM, emphasizing the urgent need for mandatory hardware-based authentication and OIDC Trusted Publishing to eliminate stealable secrets. The discussion also highlights a troubling pattern of maintainer negligence, noting that suspicious activities—such as a flurry of deleted issues used as a distraction—could have been caught sooner with better operational security. Ultimately, the community remains divided over whether the solution lies in stricter package manager controls or a more fundamental reduction of dependency trees in favor of native platform features like fetch.
38 comments tagged with this topic