A single maintainer, a fake company, and a three-hour window: inside the Axios supply chain hijack - Silicon Canals

"The most widely used JavaScript HTTP library on the internet was protected by a single person, not a security team or funded foundation, highlighting a significant vulnerability."

"The hackers posed as a real company, built a realistic Slack workspace, and lured the maintainer into a web meeting that required downloading malware."

"Once inside, the hackers pushed malicious code updates to the Axios project itself, potentially exfiltrating private keys, credentials, and passwords from thousands of systems."

"The incident is not primarily about hacking sophistication but about the consequences of an industry built on free labor without funding for security."

The Axios open source project, maintained by one individual, was compromised by state-sponsored hackers through social engineering. The attackers created a fake company and Slack workspace to deceive the maintainer into downloading malware. This allowed them to push malicious updates to the library, potentially exposing thousands of systems to credential theft. The incident underscores the risks of relying on free labor for critical infrastructure without adequate security funding, highlighting the need for better support for open source maintainers.

Read at Silicon Canals