<![CDATA[One of the worst hacks of 2026 should terrify every developer.]]>One of the worst hacks of 2026 should terrify every developer.

The popular npm package axios was compromised after an attacker hijacked a lead maintainer account and published malicious versions. Those releases pulled in a hidden dependency that installed a cross-platform RAT on macOS, Windows and Linux.

Researchers say the malware could begin phoning home in about 1.1 seconds, then delete its own installer and replace it with clean-looking files to hide what happened.

That is the nightmare: trusted packages, automated installs, almost no visible trace.

Watch: https://www.youtube.com/watch?v=eGSsoSEppNU

How much trust should we really place in package registries now?

]]>https://board.circlewithadot.net/topic/b9e95b11-32d6-47e1-acb1-48134fd06757/one-of-the-worst-hacks-of-2026-should-terrify-every-developer.RSS for NodeMon, 06 Apr 2026 05:01:53 GMTWed, 01 Apr 2026 08:53:46 GMT60