Popular JavaScript Package Axios Gets Compromised - DTNS 5237

0:00The semi-annual warehouse clearance event is on at Mattress Warehouse. Save up to$1 ,000 warehouse wide. With our lifetime price guarantee and 100 % comfort guarantee, why shop anywhere else? Limited time clearance savings only at Mattress Warehouse. Visit MattressWarehouse.com. ACAST powers the world's best podcasts. Here's a show that we recommend. Hey, it's Christy. And I'm Kelly. You might remember us as the OG partners in crime from Dance Moms. Well, this is Back to the Bar, the podcast where we drag out every insane, chaotic, and iconic moment from the show. We're spilling the tea, calling out all the BS, and sharing stuff you definitely didn't see on TV.

0:43New episodes drop every week, and yes, we're laughing through the trauma. For once. Follow, grab a drink, and join us as we go back to the bar. acast helps creators launch grow and monetize their podcasts everywhere acast.com

1:08this is the daily tech news for tuesday march 31st 2026 we tell you what you need to know give you the important context and help each other understand yeah and uh today there's a lot to understand we have a supply chain attack on a javascript package that is affecting millions of apps this is the kind of thing that that you may think doesn't affect you right away but if something goes weird you might want to know that this could be why and if you're a developer you're definitely going to want to know about this absolutely if you're a developer but we're going to get into what it actually is i'm jason howell i'm tom merit and we're going to start with what you need to know the big story.

1:47And big thank you to Motang, who noted this story in our subreddit. So much activity happening in the subreddit. Love it. One of the most popular packages for developers to get their apps front end or back end to communicate suffered a supply chain attack. This is what Tom was talking about at the top. How did they do this? Well, I'm going to hand it over to Tom, because he's the one that did some deep, deep learning on this, because it is very developer focus. Yes. Jason prompted my deep learning package. So, and security professionals, we are going to simplify some things here. So do forgive us.

2:25But I think this is mostly going to give people the accurate permission or accurate impression. And you should go dig into it more if you are affected. An attacker compromised the maintainer account of the lead maintainer of the node package manager for, as Jason said, one of the most widely used JavaScript HTTP client libraries known as Axios. This has nothing to do with the publication Axios. I was a little confused when I first started seeing the headlines here. This just happens to share the same name. Developers use the Axios NPM in apps to make requests to servers and APIs. So it's how your app is going to communicate with other things.

3:07It can manage requests between browsers, between Node.js apps, between servers, and it just makes things simple. You take this package, you put it in your app, and now you can communicate with things. And so, as you might expect, it's downloaded approximately 100 million times a week. People are putting it in their stuff all the time. The attacker was able to put a dependency in Axios 1.14.1 and Axios 0.30.4 that would install a remote access Trojan, or something very like a remote access Trojan, on machines running macOS, Windows, and Linux. So pretty much any machine. The Trojan worked a little differently.

3:48Actually, the download worked a little differently depending on the platform. But you'd end up with the same Trojan. It was disguised as a legitimate cryptography library. The malicious package was not referenced or imported anywhere in the Axios source code. So there weren't any obvious things to look for if you were scanning for it. It executed a post-install script to install a backdoor, which was capable of remote command execution. And then once it got all the stuff it wanted, removed the modified package and replaced that package with a clean file to avoid detection. So if you scanned it afterwards, you wouldn't see any trace of it.

4:32The Trojan could then execute commands and maintain persistence through reboots and all of that. They were published without an automated OIDC package origin or GitHub commit. So all that means is some of the automated alerts that would tip you off to something untoward being in there were avoided. They took like 18 hours to set up a fake history to make sure that you couldn't tell that this was coming from a compromised account. The malicious versions were actually live for about two to three hours before they were unpublished. And a security hold was placed on the affected package. If you are a user of Axios, you should lock at Axios 1.14.0 and Axios 0.30.3 and treat any system that ran the malicious packages as fully compromised.

5:29Don't try to figure out if they got in. Just assume they did. Rotate your credentials. Rebuild your environments from a pre-infection state. We don't know who did this yet. Usually there's a clue. We don't have a clue about who's responsible. Nobody's taking responsibility. It was a pretty sophisticated attack, though. So this isn't just, you know, somebody random. And we don't know who or how many apps were infected at this point or if any damage has been done as a result. Yeah, I think as I've been trying to, you know, kind of poke through some of the reporting on this and understand it on a deeper level, because I, you know, I'm not a developer.

6:09I say that all the time. I love talking about these things because I learn a lot more about, well, at least my understanding of how these things happen on the back end. But I'm sure developers listening to this understand this on a deeper level and know what the payload could potentially be if they're running apps that are running or interacting with Axios. My mind goes to the safety advice that's being kind of spread around right now is largely placed on the developers. Here's what you do if potentially your app was impacted. We are the end users on the other side. Is there anything that users should be doing?

6:49Because I'm sure a lot of people who aren't developers look at a story like this and they're like, okay, well, what can I do if I – how do I know I'm not using an app that was impacted by this and now suddenly I'm – my data is at risk. Yeah, it's a fair question. The target of this is probably the developer, not you. Okay. This doesn't necessarily mean they were going after your information. We'll find that out. And the real answer is we don't know. At the point where we're recording this, and you may know more now because you're listening to it later, we don't know who was infected. So we don't know if some app installed this Trojan, didn't get to it in time, and there's evidence that someone accessed a database and that database has your user information.

7:38Even if we did know that, there's nothing you could do about it. This is that kind of attack where there's not much you could do. And it's the kind of thing that it's not a vulnerability, I don't think, in your software on your machine. It is the kind of vulnerability that is in their back-end and front-end servers and cloud communication stuff. And the tools that they're using to create and iterate and all that kind of stuff. Right, and your information could be the target if you're dealing with a service that stores your information, but you are not the target for this. Okay. The target is that bigger payload.

8:17And because of the sophistication of it, my guess is they either wanted to cause trouble, sow discord and cause havoc, which there are plenty of sophisticated attackers out there trying to do that on purpose right now, just in order to disrupt the enemy, so to speak. A lot of Iranian hackers, a lot of North Korean hackers are doing that sort of thing. Yeah, that's where my mind went, obviously. I'm sure a lot of other people did. It could be that. We don't know. Potentially, but we don't know. I always hesitate. to throw out like, well, it looks like it might be X, because if I'm a good attacker, I want to make it look like it's not me.

8:53And so I'm going to make it look like the usual suspects, but it also might be the usual suspects. Anyway, I go down that road only to say their goal could be to just cause disruption. Their goal could also be to go after particular kinds of information and use the cloud of a massive attack to make it harder to tell what they were really after. And I guess, I mean, all things considered, it's probably cold comfort, but a couple of hours is not a huge amount of time. But when you're talking about 100 million times downloaded per week, that still ends up being a huge number. Yeah. And I would expect that a lot of developers have immediately jumped on this and locked themselves back, rolled back their versions.

9:46If you got a weird update to an app, that could be why. If you had a service outage and you don't know why there's a service outage, for instance, I tried to get my Echo to turn on my lights this morning and it was like, I can't do that right now. I was like, oh, is that just a coincidence? Probably a coincidence, but you never know. There could be something related to this. Yeah. Interesting. All right. I know a little more. Thank you, Tom. You're welcome. We like to shove know a little more in the Daily Tech News Show. That's right. And honestly, if you are a developer who's like, oh, let me shed a little extra light on this.

10:24I can answer one of those questions. I can tell you an example. Feedback at DailyTechNewsShow.com. Love it. DTNS is made possible by you, the listener. Thank you folks who support the show. Like that Charlie dude, Justin Zellers, Carmine Bailey. You want to be like them? Go to patreon.com slash DTNS.

10:49Legendary doesn't happen by chance. It happens because it's what BetMGM does. Sign up for BetMGM and receive up to$1 ,500 back in bonus bets if you don't win your first bet. Get into hockey, basketball, and more of your favorite sports with same-game parlays, live betting, and more. BetMGM. Make it legendary. BetMGM and GameSense remind you to play responsibly. See BetMGM.com for terms. 21 plus only. This specific promotional offer is not available in Michigan, Mississippi, New Jersey, New York, Nevada, Ontario, Pennsylvania, Puerto Rico, or West Virginia. Gambling problem? Call 1-800-GAMBLER.

11:22Available in the U.S. For New York, call 877-8-HOPE-NY or text HOPE-NY-467-369. For Arizona, 1-800-NEXT-STEP. From Massachusetts, 1-800-327-5050. For Iowa, 1-800-BETS-OFF. For Puerto Rico, 1-800-981-0023. First bet offer for new customers only. Subject to eligibility requirements. Rewards are non-withdrawable bonus bets that expire in seven days. In partnership with Kansas Crossing Casino and Hotel.

11:51There's plenty more we need to know today. Let's get to the briefs. Let's do. Anthropic Cloud Code had its full TypeScript source code exposed thanks to an NPM package. You just learned what an NPM package is. It is, in fact, a node package manager. This is a different sort of vulnerability. This is an own goal sort of vulnerability. the npm included a source map that pointed directly to an unprotected zip archive in anthropics r2 cloud storage maybe the zip archive shouldn't have been uh unobfuscated but definitely the npm should not have had a source map in it that source map is something you would have in there for troubleshooting you're supposed to take it out researcher chao feng shu publicly disclosed the issue today saying cloud code source code has been leaked via a map file in their npm registry the leak has about 1900 files more than 512 000 lines of typescript code major internals that cover the core llm engine details about 40 internal agentic tools also includes some flags that might indicate coming features uh you know the kind of thing you're always finding in android in advance uh they're called proactive voice mode bridge mode and Kairos.

13:16Anthropic has not, at least as we are recording this, issued a public statement about this. It's not, it's embarrassing. How critical though, because there's so like, this is like the engine that runs the knowledge, right? It is embarrassing that this happened. It is potentially going to give something to your competitors because they can now see a bunch of your source code. You don't see everything. Particularly roadmap details. But yeah, if I'm open AI, I'm having a meeting where we pour over this, see if there's anything we can learn from it about how this works. Certainly, if I'm DeepSeek or somebody else, I am too.

13:55You may or may not learn a bunch, but if I'm anthropic, I wouldn't want them to have it. There are potential security issues, but then it's also the kind of thing that can help your security because now everybody knows what your source code is and the white hats can flag vulnerability. So you get some of the benefit of an open source situation, at least temporarily, without having an open source situation. But yeah, not great, Bob. Yeah. And apparently this is not the first time this has happened with Anthropic even. It happened early 2025. That was patched. So they've got a little history with this.

14:32Kairos, by the way, there are some more details that people have been able to pull out. It really does feel like Android APKs being torn down. They're like, oh, there's a clue. Kairos being an always-on autonomous agent mode. There's something called Dream, which is nightly memory consolidation. There's Team Mem, which would be shared project memory. That could be interesting. And then this one's weird. Buddy, which is apparently a Tamagotchi-like pet system with models and ASCII art sprites. Okay. Okay. But again, this is something somebody was playing around with and set it up to be put in, but didn't launch it yet.

15:11Maybe there's a reason. That's fascinating. Yeah. I love that. Even if Tamagoshis don't come to Anthropic Cloud Code, at least we know that they considered it. That they thought about it. Yeah. Now we know. We would have never known. We would have never known. I got to ask the question. One of us has to. Did this map get left in because they vibe coded it? Oh, that's a good question to ask. Maybe we'll never know. But yeah. Yeah. If it was my fault, I wouldn't admit it. Very interesting. Samsung has been busy. We've got a couple of different related stories to Samsung. First, Samsung's new Galaxy Tab S11 Ultra Pro keyboard.

15:55So this is the keyboard accessory for the S11 Ultra. Now available in the US and Europe. It's a heavy aluminum laptop-style case. It has a trackpad. It has a dedicated AI key. turns that S11 Ultra into a near laptop. And I imagine, you know, launches Bixby and all that kind of stuff. But it costs$400. And Digital Trends notes that for only$100 more, if you're a student and you can get the discount through Apple, you can buy a MacBook Neo. So value proposition probably depends on whether you're in the Apple ecosystem. Or you don't have to spend $100 and you get the Galaxy Tab S11. There you go.

16:36That's a better way to think about it. Actually, both are compelling, depending on your... Yeah, totally. Samsung also just activated blood pressure tracking on Galaxy Watch 4 and newer devices running Wear OS 4.0 in the US. The feature does require the Samsung Health Monitor app to be installed. Also requires periodic calibration with a separate cuff every 28 days in order for it to continue to work. And with that, you get, what is it, systolic and diastolic measurements. Yeah, that's your 180 over 70 stuff. Right, right. And Samsung is, by the way, labeling this as a wellness tool, not something that they say, quote, is used to prevent or diagnose high blood pressure.

17:22So it's neat that it can do it, but don't rely on it, basically. Kind of what I understand it anyways. Anyways, Samsung also launched a hear-a-p, hear, H-E-A-R-A-P, so hear therapy kind of combined. Too clever. They're trying to do hear and therapy together, and I get it. It's one of those words that looks better than it sounds. Yeah. Sometimes that happens. Anyways, it's an app called hear-a-p to reduce motion sickness, and I've not heard of this before, by playing 100 hertz frequencies, so really low frequencies, for 60 seconds at a time into headphones that can support those frequencies. Of course, Samsung's earbuds can do that.

18:05It's meant to stimulate the inner ear balance system. And it's actually based on research from Nagoya University in Japan, where they learned that playing those tones uninterrupted can actually improve balance of the wear inside of the headphones. So interesting approach. Inner ear is important to balance. So that kind of ties in. I like that you could use... Tizen? Did you do that on purpose, Tizen? I did not. I wish I had. I'm going to pretend that I did, though. That's funny. If you know, you know. I love that this would work even if you're not using Samsung's buds. As long as you've got a device that can play 100 hertz frequencies, which most of your earbuds can, you can take advantage of this.

18:50That's cool. I mean, 100 hertz is not like ultra, ultra low. I think that's pretty baseline for most headphones. You would have had to buy your headphones on Timu for them not to be able to. Totally. Totally that. Meta is releasing a new version of its Ray-Ban smart glasses, refreshing their Gen 2 model with two new, more prescription-friendly styles. This is so confusing to me. It doesn't seem to be confusing too many other journalists out there, but you can do prescription lenses in the Ray-Bans right now, but these are more prescription-y. We'll get to why that might be. Blazer Optics gives you the more squared approach, and Scripter Optics give you a rounded design.

19:35So there's also a change in the frame design. They start at$499 before you spend money on the lenses. The lenses are going to cost you extra. The frames are slimmer, a little bit slimmer, have swappable nose pads, adjustable temple tips, and a design that works with a wider range of prescription lenses, including progressives and transitions. And that temple tips and adjustable stuff is one of the reasons these are better for prescriptions because your optician can then use them to fine tune the adjustment. So that's part of this too. Meta also launching some new software features along with this that'll go to the full Meta Glasses lineup.

20:13That includes expanded Meta AI translation support for Japanese, Mandarin, and Arabic, along with food and nutrition tracking through on-device image analysis. You just look at your food, take a picture. Neural handwriting on the MetaRayBand display is rolling out to everybody in the coming weeks. It'll let you write with your finger on any surface so that you can silently reply to a message. That'll work with Instagram, WhatsApp, Messenger, and native Android and iOS messaging apps. Ooh, that's kind of cool. I want to play around with that and see if that's actually as useful as it kind of sounds.

20:50And there's definitely times when you don't want to say your response out loud. Yeah. Like, yes, I'm still stuck with this boring guy. I'll message you when we're done, right? Like, that might not be something you want to say out loud. And he's like, what are you scribbling on the, you know, in invisible ink on the table right now? I'm taking imaginary notes on these fascinating things you're saying right now. The Ray-Ban Meta Blazer Optics Gen 2 and Scriber Optics Gen 2 will be available at U.S. Optical Retailers. That's another part of this. You can go to your local optical store and get them, as well as select international markets starting April 14th.

21:30Right on. Well, you know, people ask, I mean, I've been on the show a number of times in the last couple of last month or so, where people are constantly curious about the prescription implications of these things. And it's not like the previous Ray-Bans couldn't do prescriptions, like you said. But like the different shapes of the frames and everything, is that just because, I mean, that requires a different type of cut for the lenses? And maybe that's the specificity that this is solving. Yeah. Now you can do different types of things. Part of it, right? You now get the typical style choices that you can get for your lenses.

22:06Some people have a particular type. The frame is part of the style, right? But then the lens shape is also part of the style and part of the working of it. Good. Well, then all this does is bring those smart glasses even closer to normal glasses, which I think is just necessary. I guess the difference was before you would order your Ray-Bans and say, here's my prescription and whatever they could do to put it in there, they would, but you couldn't get them fine-tuned with the nose pads and all of that. You couldn't get a particular shape of lens. You couldn't get transitions. And now you can't.

22:38You can do almost all the things you would do if you bought the glasses from your optometrist. Yeah, solid. Yeah. Well, folks, if you want to tell us why they still left out that one feature that you need from your glasses or anything else, We're having great conversations in the Discord these days, by the way. Join in. You can join your Patreon account to Discord and get in on the conversation. Just link your Discord to your Patreon account at patreon.com slash DTNS.

23:24into hockey, basketball, and more of your favorite sports with same-game parlays, live betting, and more. Bet MGM. Make it legendary. Bet MGM and GameSense remind you to play responsibly. See BetMGM.com for terms. 21 plus only. This specific promotional offer is not available in Michigan, Mississippi, New Jersey, New York, Nevada, Ontario, Pennsylvania, Puerto Rico, or West Virginia. Gambling problem? Call 1-800-GAMBLER. Available in the U.S. For New York, call 877-8-HOPE-NY or text HOPE-NY-467-369. For Arizona, 1-800-NEXT-STEP. For Massachusetts, 1-800-327-5050. For Iowa, 1-800-BETS-OFF. For Puerto Rico, 1-800-981-0023.

24:05First bet offer for new customers only. Subject to eligibility requirements. Rewards or non-withdrawable bonus bets that expire in seven days. In partnership with Kansas Crossing Casino and Hotel.

24:17All right. We got a bunch of quick headlines that are good to know and make you look real smart while you're wearing those new Ray-Bans that you're about to get because of the description and all that. You're going to look smarter than Ronald Wayne did when he joined Steve Jobs and Steve Wozniak to file a partnership for Apple 50 years ago today. Happy 50th birthday to Apple. and everybody pitched in and got Tim Cook a little something. He got to ring the NASDAQ opening bell just as he dreamed when he was a child, I guess. I don't know. You're welcome, Tim. It's a thing they do. We did that for you.

24:5350 years. Wow. Yeah. I was today years old when I realized that I'm as old as Apple. So there you go. Maybe not exactly. Today's not my birthday. I was six years old when they filed that paperwork. Crazy. Probably eating an apple. Yeah, I was. Yeah. I remember. Oh, I remember that day well. SpaceX reported that Starlink satellite 34343, for those who are counting, broke apart after an in-orbit anomaly, likely an internal failure, not a collision. This happened on March 29th. And yes, it sprinkled debris in orbit. Though analysis has concluded that that debris is not a threat to the ISS, the Artemis 2, or other Starlink missions.

25:40Just in time for people to go back to the moon. We just sprinkle a little dust. I heard another way of referring to this. SpaceX reported that Starlink satellite asploded. Asploded. Love it. It asploded. Haven't heard that in a while. uh instagram will reduce its use of the pg-13 label for teen accounts and add a disclaimer after reaching a deal with the motion picture association after the motion picture association who has never seen a cease and desist it doesn't want to send sent one to meta uh which called instagram's pg-13 language false and highly misleading that's our label only the mpa gets to say something's PG-13.

26:23Yeah, unless we strike a deal. Unless we strike a deal. Let's talk. And you put a long disclaimer to make it really confusing. It's been a long time coming, but Google is officially rolling out the ability for U.S. users to change their Gmail address in account settings one time per year. You keep that old address in the link for an alternate login so that doesn't entirely go away. All your inbox email and everything is preserved in the process. You're going to do it, Tom? No, no, no. I probably should. My personal email address is totally the kind you make when you're like fresh out of college.

27:02My Gmail address was the first one I didn't make Ace Detect. Oh, okay. Yeah. So I'm fine. You're smarter than I was. I'm good. But it is kind of fun to have an alternate email address, I guess. Oh, that's true. I mean, you'd have them both. Yeah. Because you keep the old one. Oh, yeah. I hadn't considered that. Yeah, that's true. Maybe I'll do it. Google Drive has a new ransomware detection feature coming out of beta that auto pauses sync alerts collaborators and restores clean file versions by default for all users. Just a nice way to automatically protect you against ransomware. Thank you, Google Drive.

27:40Thank you. Proton Workspace. It's a new encrypted business suite. It handles all Proton's suite of apps and services, mail, calendar, drive, docs, sheets, and VPN, along with a new Proton Meet app for private audio and video calls and chats. The suite starts at$12.99 per user per month. That's kind of the baseline and then upgrades for premium users and then, of course, enterprise users as well. Man, I use Proton Pass and I have Proton Mail. Well, I'm telling you, Proton's on the march. Raspberry Pi Holdings reported 2025 revenue up 25 % year over year on strong industrial demand from the U.S.

28:24and China after raising prices twice in four months to cover higher memory chip costs. As long as nothing stops industry from having demand, they'll be fine. Yeah. So that's working for them. What could go wrong? Go Raspberry Pi. Yeah. Nothing. Everything's going to be great. tom that's how i feel uh thanks to rw nash in the subreddit for passing along that apple briefly and mistakenly began rolling out its apple intelligence features to some iphone users in china before securing cyberspace administration approval which is required before it could do that apple has since removed the features yeah they have to try all variations of tank man on apple intelligence before they can approve it uh reviews of the apple airpods max 2 are out In a 9 to 5 Mac interview, Tim Millett, Apple VP of Platform Architecture, shared that the one and a half times stronger active noise cancellation is due to the new H2 chip's compute power and improved algorithms.

29:25In other words, it better. It's better with software, not hardware. I think that's kind of what I walked away with. It's not like some big newly inserted hardware thing. I mean, unless you consider the H2 chip hardware. Which it is. but yeah mostly so yeah it is uh amazon is rolling out alexa plus food ordering on echo show eight and larger devices so users can now link your grubhub account your uber eats account uh you can browse and place orders using of course natural language if you're talking to it or on screen controls if you prefer if you got the display i'm gonna have to do this i'm gonna have to order some food just to test this out oh dang and it is tuesday some delicious food might have to be tacos okay all right you do you man i love tacos order me some too uh we end every episode of dtns i wonder if you could order and have it delivered to me you probably could i can uber eats does that i think doordash does it too we end every episode of dtns with some shared perspectives and today why ryan oh did i is that yeah i don't know where that came from it's just ryan Let me try that again.

30:36Ryan, no Pui involved, would love a tiny Mac Mini along the lines of a MacBook Neo. Yes, Pui writes, I'm sorry, Ryan writes, that was in our script. Neither one of us know where it came from. Anyway, Ryan, we apologize. Ryan writes, I would love a Mac Mini for sub$300 that's that small. This is something Rob and I were speculating on yesterday. I've installed a few stick PCs or mini PCs on the back of TV screens in business settings with wireless keyboards and mice for video conferencing systems and basic web browsing for meetings. Being able to do it with Mac instead of Windows would be very appealing in the media space.

31:16Interesting. That sounds very appealing. And I would normally say, oh, Apple will never do that. But I mean, hey, the Neo came out. Yeah, we were like, what if they did what they're doing with the Neo, but in a small form factor for the Mac Mini? And we were like, but who would want that? And Ryan's like, me. I would want that. Thank you. Please do that. I think it would find a lot of use. I think you're right. Well, if you have got something you think would get a lot of use and you want to tell us about it, there's always room for more insight into a story. If we don't get to it here, we often get to it on our Mailbag live stream on our YouTube channel as well.

31:53but do share it with us feedback at dailytechnewsshow.com yes and thank you to sorry ryan for contributing to today's show and thank you for being along for daily tech news show you can keep us in business by becoming a patron at patreon.com slash dtns see you later everybody

32:17the dtns family of podcasts helping each other understand The Diamond Club hopes you have enjoyed this program.

32:52Every insane, chaotic, and iconic moment from the show. We're spilling the tea, calling out all the BS, and sharing stuff you definitely didn't see on TV. New episodes drop every week, and yes, we're laughing through the trauma. For once. Follow, grab a drink, and join us as we go back to the bar. Acast helps creators launch, grow, and monetize their podcasts everywhere. Acast.com.