.

[. @Sagishidev]

CA HkjnsBtymiWMgt7jMRKdj9TcReKBH13enpksZtLKpump

[. @Sagishidev]

In a plot twist no one asked for, an elite Twitter provocateur who spent years daring strangers to “do your worst” was shot dead yesterday, and the internet responded with the usual mix of solemnity, laughter and memes.

[philip lewis @Phil_Lewis_]

32-year-old Mike Menard was fatally shot while sitting inside his vehicle in Fort Lauderdale, authorities said https://t.co/JEbw5IgbD8

[. @Sagishidev]

more details

[Anish Moonka @anishmoonka]

A tiny piece of code called axios runs inside almost every app on your phone and every website you visit. Developers download it 100 million times a week. A few hours ago, someone poisoned it with malware that hands an attacker full control of your computer.

If you’ve never heard of axios, that’s normal. It does one boring but important job: it lets apps talk to the internet. When a website pulls up your feed or an online checkout processes your card, axios is probably doing the work underneath. Over 173,000 other code packages plug into it. It’s everywhere.

The attacker stole a lead developer’s login for npm (think of it as an app store, but for code that programmers use to build software). Once inside, they swapped the developer’s email to an anonymous ProtonMail account and uploaded the poisoned version by hand. That jumped past every security check the project normally runs before new code goes live.

And this was not some rushed job. The attacker staged the malware at least 18 hours before pulling the trigger. They built separate versions for Windows, Mac, and Linux. They poisoned both the current version and an older one within 39 minutes of each other, casting the widest net possible. Once the malware ran on a machine, it deleted itself to cover its tracks.

The trick was smart. They never touched a single line of code inside axios itself. Instead, they tucked in a fake add-on called plain-crypto-js, built to pass as a well-known, trusted library. It copied the real library’s description and author info, so nothing looked off at a glance. When a developer installed axios, this fake package quietly ran the malware on its own.

When a smaller package called ua-parser-js got hijacked back in 2021 with about 8 million weekly downloads, the security world treated it like a four-alarm fire. Axios has 100 million. Over 12x the exposure, with 173,000+ packages depending on it.

Socket, the security firm that flagged this, caught it in about 6 minutes. That’s fast. But 6 minutes is still plenty of time for automated systems at companies everywhere to pull and install the bad version before anyone can react.

If you or your team runs axios: lock your version to 1.14.0 (or 0.30.3 for the older branch). Change every password, API key, and access token on any machine that installed the compromised update. And check your network logs for connections to sfrclak dot com or the IP address 142.11.206.73.

[. @Sagishidev]

CT dont know how big this is

[Prasenjit @prasenx]

🚨CRITICAL: Axios got hacked. here's what happened:

→ attacker hijacked a lead maintainer's npm account
→ swapped the email to an anonymous protonmail
→ bypassed GitHub Actions entirely
→ manually pushed [email protected] via npm CLI

the malicious version injects [email protected] a package that didn't exist before yesterday.

it's a full RAT dropper, one npm install and it:

→ runs a postinstall script silently
→ detects your OS (mac, windows, linux)
→ downloads a platform-specific payload
→ deletes itself after execution
→ replaces its own package.json with a clean decoy

you check your node_modules after, everything looks normal, but the damage is already done.

axios has 100M+ weekly downloads, this isn't some random package, it's in almost every JS project you've ever touched (including me)

if you use axios:
→ pin your version to 1.14.0 or below
→ audit your lockfiles right now
→ do NOT run npm install with latest
→ check if plain-crypto-js exists in your node_modules

this is the most sophisticated npm supply chain attack we've seen on a top-10 package.

stop trusting npm install blindly.

[. @Sagishidev]

@NBA wow

[. @Sagishidev]

Dex Paid

[. @Sagishidev]

INSANE NEWS , one of the most used npm packages with over 100m weekly downloads just got hacked.
This npm powers a lot of major websites like Tiktok, Chevron, Upwork

Ca:74zHiVFed825s2NJmvhxXkMmdHZkg3eSr54jTNdVpump
Dex at 15k
cashback

https://t.co/5XP7B7Mu8O

https://t.co/1SC0iClYDi

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[. @Sagishidev]

man what a rain tonight

[. @Sagishidev]

going to get lunch then back to work

[. @Sagishidev]

@RoronoaZoL U mod

[. @Sagishidev]

gna talk more about em tomorrow

[. @Sagishidev]

had a lot of fun this past weekend

[. @Sagishidev]

dont take me for a fool

[. @Sagishidev]

devvin memes is hard lol

[. @Sagishidev]

@NBA i will tune in

[. @Sagishidev]

@nikitabier i am not a bot pls

[. @Sagishidev]

Can twitter let me breathe?

[. @Sagishidev]

wna go get food

[. @Sagishidev]

sports better watched in pubs