Anatomy of a supply-chain compromise

The axios npm compromise, March 2026. Two weeks of patient setup, then the whole blast in a three-hour window. Every stage lived in the operation, none in the package's code. Press play to watch it descend.

Mar 17 → Mar 31 2026 6 stages ~100M weekly installs at risk ~3 hrs exposure window

Stage time—

first contactpublishtakedown

Stage

Ready

press play

Where it lives

the operation

never the code

Blast radius

—

grows each stage

A cloned company and a staffed Slack workspace are being built. Nothing has been attacked yet.

Attack chain, across trust boundaries

Reconstructed from the lead maintainer's post-mortem (axios issue 10636), the CISA alert of April 20, 2026, and Huntress telemetry. Times are UTC on March 31, 2026; the pretext window is approximate. The stage durations here are for legibility and do not represent real elapsed time, which was two weeks of setup and roughly three hours of blast.