# package compromise Published articles for package compromise. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Axios package compromise and remediation steps DevFeed: [Axios package compromise and remediation steps]() Original publisher: [Read original article]() Author: Vercel Security Published: 2026-03-31T13:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [npm](), [vulnerability](), [API keys](), [Databases]() Tags: [2026](), [axios](), [dependency](), [package-compromise](), [registry](), [supply-chain](), [tokens](), [update](), [vercel](), [vulnerability]() ### AI overview Vercel describes the compromise of the axios npm package in an active supply chain attack discovered on March 31, 2026. The affected versions are axios@1.14.1 and axios@0.30.4, with plain-crypto-js@4.2.1 also identified in compromised dependency chains. Vercel says its systems, infrastructure, and applications were not affected, and reports that the malicious versions were blocked and unpublished while the latest tag points to axios@1.14.0. ### Source excerpt The axios npm package was compromised in an active supply chain attack discovered on March 31, 2026. Vercel investigated this issue and implemented remediation actions to protect the platform. No Vercel systems were affected. The npm registry removed the compromised package versions, and the latest tag now points to the safe axios@1.14.0 release. We've blocked outgoing access from our build infrastructure to the Command & Control hostname sfrclak.com. The malicious version of the package has been blocked and unpublished from npm. Vercel's own infrastructure and applications have been unaffected. We recommend checking your supply chain for exposure. Affected versions Projects using axios@1.14.1 or axios@0.30.4 in their build environments are affected by this vulnerability. Check your dependencies and lockfiles for: axios@1.14.1 axios@0.30.4 plain-crypto-js@4.2.1 Resolution If your deployments used the malicious package version listed above in your build environment, take the following actions: Search your lockfiles and node_modules for plain-crypto-js to identify compromised installations Redeploy your project to ensure your build uses a clean version of axios Rotate API keys, database credentials, tokens, and any other sensitive values present in your build environment Review your dependency tree for references to axios@1.14.1 or axios@0.30.4 and update them to axios@1.14.0 Read more ## Announcing Chainguard Libraries for JavaScript: Malware-Resistant Dependencies Built Securely from Source DevFeed: [Announcing Chainguard Libraries for JavaScript: Malware-Resistant Dependencies Built Securely from Source]() Original publisher: [Read original article]() Published: 2025-09-25T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard libraries](), [JavaScript](), [Malware](), [npm packages](), [npm]() Tags: [attacks](), [chainguard](), [chainguard-libraries](), [chainguard-libraries-for-javascript](), [javacript](), [javascript](), [language-library-security](), [malware](), [npm](), [npm-packages](), [package-compromise](), [provenance](), [shai-hulud](), [slsa]() ### AI overview Chainguard announces Chainguard Libraries for JavaScript, a source of trusted language-dependency builds intended to protect developers and organizations from compromised packages, malicious updates, and registry-based attacks. The libraries are built from source on hardened SLSA L2 infrastructure, include provenance, and are designed to fit existing developer workflows. ### Source excerpt Chainguard Libraries for JavaScript is designed to protect developers and organizations from compromised packages, malicious updates, and registry-based attacks. ## Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack DevFeed: [Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack]() Original publisher: [Read original article]() Author: Brian Clark Published: 2025-09-15T11:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Malware](), [npm packages](), [Cybersecurity](), [Angular](), [Bootstrap](), [GitHub Actions](), [API keys](), [GitHub](), [incident](), [Security](), [data](), [Front end]() Tags: [2025](), [angular](), [api-keys](), [awareness](), [blog](), [cybersecurity](), [developer](), [devrel](), [github](), [github-actions](), [incident](), [malware](), [npm](), [package-compromise](), [secrets](), [security](), [shai-hulud](), [supply-chain](), [supply-chain-security](), [worm]() ### AI overview This article reports the Shai-Hulud supply chain attack, in which malicious versions of ngx-bootstrap and other npm packages embedded malware to harvest developer tokens, cloud credentials, API keys, and other secrets. The malware exfiltrated data through webhooks and public GitHub repositories, targeted CI/CD environments through GitHub Actions, and spread across hundreds of compromised packages. The article recommends treating affected systems as compromised, removing the packages, rotating secrets from a trusted machine, and investigating for lateral movement. ### Source excerpt A supply chain attack hit the ngx-bootstrap npm package, embedding malware to steal developer credentials. See affected versions (e.g., 20.0.4-6, 19.0.3) and our playbook to contain the threat and rotate compromised secrets. ## Lottie Player npm package compromised for crypto wallet theft DevFeed: [Lottie Player npm package compromised for crypto wallet theft]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-10-31T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [npm](), [Vulnerabilities](), [Cryptocurrency](), [snyk](), [Security](), [supply-chain-security](), [Command-line interface]() Tags: [awareness](), [blog](), [cli](), [code-security](), [crypto](), [dependency](), [developer](), [devrel](), [incident](), [npm](), [package-compromise](), [security](), [snyk](), [snyk-code](), [supply-chain](), [vulnerabilities]() ### AI overview The @lottiefiles/lottie-player npm package was compromised after an npm registry publishing token was exposed. Malicious code in versions 2.0.5, 2.0.6, and 2.0.7 attempted to prompt users to connect cryptocurrency wallets. Those versions were removed, and version 2.0.8 restored the safe project code. The article explains how to use Snyk Dependency Reports and the Snyk CLI to identify affected projects and vulnerable dependencies. ### Source excerpt On October 31st, 2024, another package compromise and cryptocurrency hijack story unfolded for a popular npm package. Scan open source dependencies and container images in the CLI or your SCM with Snyk to determine if you're using one of the vulnerable versions of lottie-player, and potentially uncover any other security vulnerabilities you may have in your projects.