DEV Community

CyborgNinja1
CyborgNinja1

Posted on • Originally published at shieldcortex.ai

The axios Attack Was a Wake-Up Call. Your AI Agent Just Ran npm install Without Asking You.

#security #javascript #ai #npm

The axios 1.14.1 supply chain attack hit packages with 100M+ weekly downloads. But here's what nobody's talking about — AI coding agents run npm install autonomously. No human reviews the packages. No human checks the lockfile. Your agent just trusts npm.

This isn't a hypothetical. It happened this week.

What Happened

On March 31, 2026, an attacker hijacked a lead maintainer's npm account for axios — one of the most widely used JavaScript packages in existence. They:

  1. Swapped the maintainer's email to an anonymous ProtonMail
  2. Bypassed GitHub Actions entirely
  3. Manually pushed axios@1.14.1 via the npm CLI

The malicious version injected plain-crypto-js@4.2.1 — a package that didn't exist before that day.

It's a full RAT dropper. One npm install and it:

  • Runs a postinstall script silently
  • Detects your OS (macOS, Windows, Linux)
  • Downloads a platform-specific payload
  • Executes it
  • Deletes itself after execution
  • Replaces its own package.json with a clean decoy

You check your node_modules after — everything looks normal. But the damage is already done.

Why AI Agents Make This Worse

Here's the uncomfortable truth that nobody in the AI tooling space is talking about:

AI coding agents run npm install without human review.

Claude Code, OpenAI Codex, Cursor, Windsurf — when these agents need a dependency, they install it. When they scaffold a project, they run npm install. When they fix a build error, they might add a package.

A human developer might notice something off:

  • "Wait, why is there a postinstall script?"
  • "I don't remember adding plain-crypto-js"
  • "Why did 3 new transitive dependencies appear?"

An AI agent won't notice any of this. It sees npm install succeed, marks the task as done, and moves on. The RAT is already running on your machine.

Your AI agent has shell access. That makes it an attack surface.

It Gets Worse: Real-Time Weaponisation

The same day the axios attack landed, Claude Code's source was exposed via npm sourcemaps. Within hours, attackers registered typosquat packages targeting developers who tried to compile the leaked source:

  • color-diff-napi — squatting an Anthropic internal package name
  • modifiers-napi — same attacker, disposable email

Supply chain attacks are now reactive. Attackers watch trending repos and weaponise them in real-time. If your AI agent is installing packages from a hot new project, it's walking into a trap.

What Snyk and npm audit Miss

Traditional security tools (Snyk, Dependabot, npm audit) check for known CVEs — vulnerabilities that have already been reported, catalogued, and assigned an advisory number.

The axios 1.14.1 attack wouldn't have been in Snyk's database for hours after publication. During those hours, every npm install was compromised.

What's needed is zero-day detection:

  • Flag packages that didn't exist yesterday
  • Detect typosquats by name similarity (Levenshtein distance)
  • Scan postinstall scripts for payload downloads, OS detection, credential access, self-deletion
  • Block known malicious packages instantly, before any CVE exists

What We Built

At Drakon Systems, we run a fleet of 6 AI agents that manage everything from school administration to e-commerce operations. When the axios attack hit, we asked ourselves: "Would our agents have caught this?"

The honest answer was: partially. Our memory security layer (ShieldCortex) would catch credential exfiltration through agent memory, but it couldn't intercept npm install itself.

So we built a dependency scanner. In 24 hours.

$ shieldcortex audit --deps

  [X] CRITICAL  Known malicious: plain-crypto-js
  [!] HIGH      Typosquat detected: "axois" → "axios"
  [!] HIGH      Suspicious postinstall: downloads payload, detects OS
  [~] MEDIUM    New package (< 7 days) with install script

  🛡️ Run with --auto-protect to quarantine threats automatically
Enter fullscreen mode Exit fullscreen mode

What it checks:

  1. Known malicious blocklist — plain-crypto-js, color-diff-napi, modifiers-napi, and every known bad package. Finding = instant CRITICAL.

  2. Typosquat detection — Compares every installed package name against 34 popular packages using Levenshtein distance. axois? Flagged. loadsh? Flagged. crytpo-js? Flagged.

  3. Suspicious postinstall scripts — 16 regex patterns covering:

    • Payload downloads (curl, wget, fetch)
    • Command execution (exec, spawn, child_process)
    • OS fingerprinting (process.platform, os.type())
    • Self-deletion (rm -rf, unlink)
    • Credential access (.ssh, .aws, .npmrc, HOME)

  4. Package age — Flags packages published in the last 7 days that have install hooks. Brand new + postinstall = suspicious.

Pro tier adds teeth: 

# Scan and auto-quarantine critical threats
shieldcortex audit --deps --auto-protect

# Permanently remove known malicious packages
shieldcortex audit --deps --clean --force
Enter fullscreen mode Exit fullscreen mode

Free users see the fire. Pro users put it out.

The Uncomfortable Question

Every AI coding agent on the market today has some form of shell access. They can run npm install, pip install, cargo add, go get. Each of these is an unsigned code execution on your machine.

We've given AI agents the ability to install arbitrary code, and we're trusting the package registry to be safe.

After this week, we know it isn't.

If your AI agent has shell access, you need a supply chain firewall. Not eventually. Now.

Get Started 

npm install -g shieldcortex
shieldcortex audit --deps
Enter fullscreen mode Exit fullscreen mode

Scan your project. Check your global installs. See what's lurking in your node_modules.

The axios attack was a wake-up call. The question is whether you'll hit snooze.

Built by Drakon Systems — we run 6 AI agents in production. Security isn't theoretical for us.

Top comments (0)