The Axios npm Supply Chain Attack (March 2026): A 2-Second Breach Window That Compromised the JavaScript Ecosystem

You run npm install. It’s muscle memory at this point. Dependencies resolve. Progress bar moves. Nothing unusual. 1.1 seconds later — your machine has already made an outbound call to a command-and-co