Click any tag below to further narrow down your results
Links
The article discusses a recent supply chain attack involving the popular Axios package, highlighting how an attacker installed malware without altering the original code. It emphasizes the challenges posed by AI in both coding and attacking, as automated systems can easily introduce vulnerabilities faster than traditional security measures can respond.
- Attackers hijacked a maintainer account and slipped a self-deleting RAT into Axios (100M+ weekly downloads) via a malicious dependency, leaving no CVE for traditional scanners to catch.
- AI coding agents are 50% more likely than humans to pick known-vulnerable dependencies and often hallucinate package names that attackers exploit via "slopsquatting."
- Attacks have shifted from targeting single packages to automated, ecosystem-wide worms, like the TeamPCP campaign that spread through 66 npm packages in days.
- Socket detected the malicious Axios dependency in 6 minutes by analyzing code behavior, versus the industry-average 267 days for breach detection.