The Axios Attack Proved Vibe Coding's Biggest...

Yesterday, for roughly two hours, every npm install of the world's most popular HTTP client installed a Remote Access Trojan on your machine. The axios package -- over 100 million weekly downloads, present in approximately 80% of cloud environments -- was compromised on March 30, 2026. A threat actor hijacked maintainer "jasonsaayman"'s npm account, published malicious versions axios@1.14.1 and axios@0.30.4, and within 2 seconds of npm install, before npm even finished resolving other dependenci