Supply Chain Attacks Start in Your Build Cache

Sat, 11 Apr 2026 00:00:00 +0000

On March 25, 2025, a malicious version of the axios npm package (version 1.14.1) was published to the npm registry. It contained a bundled dependency called plain-crypto-js@4.2.0, which was later confirmed to be malicious. The package was identified and removed from the npm registry within roughly three hours.

For most organizations, three hours sounds manageable. For us, it wasn’t that simple.

Container Orchestration on Cliff Hults

Supply Chain Attacks Start in Your Build Cache