Alright, I've got the full picture now. Let me break this down for the panel.
Question 1: Is SOCRadar Labs coverage surfacing NEW evidence or delayed analysis?
This is a delayed analysis, not new evidence. The Axios compromise happened March 31, 2026 — over two months ago. The SOCRadar CISO guide published this month is a retrospective compilation of IOCs and remediation guidance, not fresh incident reporting.
According to Datadog Security Labs and Huntress, the timeline was tight: malicious versions [email protected] and [email protected] were published at 00:21 and 01:00 UTC on March 31, and npm security unpublished them by 03:15 UTC — roughly a 2-hour exposure window. The Huntress telemetry shows the first macOS infection occurred at 00:23:27 UTC, just 89 seconds after the malicious 1.14.1 publish. That's how fast this moved.
The trust failure point here was maintainer account compromise via social engineering — the attacker RATted the lead maintainer's machine, stole npm credentials, and pushed directly to the registry. This wasn't a source code compromise; the Git repo was clean.
Question 2: Maintainer hijack vs. typosquat — structural differences in blast radius and detection
Look, these are fundamentally different trust failures with opposite detection profiles.
Typosquatting (like event-stream or the Shai-Hulud campaigns) relies on developer error — mistyping a package name. The blast radius is limited to users who make that specific typo. Detection is relatively straightforward: new package with suspicious name pattern, no legitimate maintainer history, rapid version churn. Socket.dev and similar tools flag these within minutes of publish.
Maintainer account hijacks like Axios and node-ipc are far nastier. The blast radius is massive — you're pushing malicious code through the legitimate package's established trust channel. Every user with a semver range like ^1.0.0 or ~1.14.0 auto-updates into the compromise. The Axios package has 83M+ weekly downloads; even a 2-hour window means tens of thousands of potential infections.
Detection is harder too. The package name is correct. The maintainer account is legitimate — just compromised. The version numbers follow normal patterns. The node-ipc case in March 2022 showed this clearly: the maintainer pushed "protestware" through their own package, and it took hours for the community to notice. Same pattern here — Socket flagged [email protected] at 00:05 UTC (6 minutes after publish), but that was a decoy dependency. The actual axios malicious versions weren't caught until runtime behavior analysis caught the RAT drop.
Question 3: npm registry controls since March — and what operators should do NOW
npm has not implemented systemic changes that would prevent a repeat. The registry response was reactive, not structural:
- They unpublished the malicious versions within ~3 hours
- They placed a security hold on
plain-crypto-js
- They published clean security stubs
But the fundamental architecture remains: publish happens immediately, verification happens after. According to Socket.dev's reporting, npm is pushing maintainers toward trusted publishing (OIDC) and revoking classic tokens, but this is opt-in guidance, not enforcement. There's no mandatory 2FA for publishing, no dependency cooldown periods, no provenance attestation requirements.
For operators who consumed axios between March 28-April 2, here's what you do right now:
Check your lockfiles — if you have [email protected] or [email protected], assume compromise. The RAT drops to /Library/Caches/com.apple.act.mond (macOS), %PROGRAMDATA%\wt.exe (Windows), or /tmp/ld.py (Linux) and phones home to sfrclak.com:8000.
Hunt for C2 beacons — the malware is self-erasing, so file-based IOCs may be gone, but network logs to sfrclak.com persist.
Rotate all secrets — if that RAT executed on a dev machine, assume credential exfiltration. This is the same pattern we saw with TrapDoor: the initial compromise cascades.
Pin by hash, not version — package-lock.json with integrity hashes would have caught the mismatch. Semver ranges are a trust-failure amplification mechanism.
Enable Sigstore verification where available, and run SCA in CI with behavioral analysis — static manifest checking won't catch maintainer account takeovers.
The broader lesson: you audited your 20 direct dependencies. Axios is probably one of them. But how many of your 1,200 transitive dependencies have maintainers using MFA? How many have you even heard of? That's where the next Axios lives.