---
title: "A new, major npm supply chain attack via Axios"
publication: "JavaScript Weekly"
issue: 779
published_at: "2026-03-31"
canonical_url: "https://javascriptweekly.com/issues/779"
---

Plus running AI models in-browser with Transformers.js v4, signals explained, and using Knip v6 to rapidly clean up your codebase.        

#​779 — March 31, 2026 

[Read on the Web](https://javascriptweekly.com/issues/779)  

Together with [![Meticulous\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_2600,h_373/e_make_transparent/co_white,e_outline:30/s65exulzcd60xe2r5nyk.png)](https://www.meticulous.ai?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q1&utm_content=primary)   

JavaScript Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/hscgioobwckiiyh4eyof.jpg)](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan)  

[`axios` Package Compromised; Malicious Versions Added a Trojan Dependency](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan) — [Axios](https://axios-http.com/) is an HTTP library that gets 100M+ downloads a week, largely due to its legacy popularity. An attacker took advantage of that to roll out a version with a malicious dependency including a remote access trojan (though Axios' codebase _itself_ was fine). This is big, as even if _you_ don’t use Axios, your dependencies might. Here's [how to see if you're affected.](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan#am-i-affected) 

Ashish Kurmi   

💡 **More:** Socket offers [a more accessible breakdown](https://socket.dev/blog/axios-npm-package-compromised). There's also [a GitHub issue](https://github.com/axios/axios/issues/10604) discussing the matter. It's worth considering [pinning your dependencies](https://maxleiter.com/blog/pin-dependencies), preventing post-install scripts from running (can be configured with `npm` but is the default in pnpm and Bun) and/or using cooldowns for dependency updates (using [`minimumReleaseAge`](https://socket.dev/blog/npm-introduces-minimumreleaseage-and-bulk-oidc-configuration) in npm or [pnpm's approach](https://pnpm.io/supply-chain-security)).  [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/1f750717.png)](https://www.meticulous.ai?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q1&utm_content=primary) 

[Still Writing Tests Manually? Meticulous AI Is Here](https://www.meticulous.ai?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q1&utm_content=primary) — Notion, Dropbox, Wiz and LaunchDarkly now use a testing paradigm they can’t work without. Built by former Palantir engineers, Meticulous automatically creates an evolving suite of E2E UI tests, delivering exhaustive coverage with no developer effort. 

Meticulous sponsor   

[Transformers.js v4: Run AI Models in the Browser](https://github.com/huggingface/transformers.js/releases/tag/4.0.0) — Brings [Hugging Face](https://huggingface.co/)-hosted transformer models into JavaScript, so you can run NLP, vision, and audio models in-browser. v4 switches to a WebGPU runtime and is installable with npm. There are [many live demos](https://huggingface.co/collections/webml-community/transformersjs-v4-demos) covering [real-time speech transcription](https://huggingface.co/spaces/mistralai/Voxtral-Realtime-WebGPU), [using Qwen 3.5](https://huggingface.co/spaces/webml-community/Qwen3.5-WebGPU), and [real-time video captioning.](https://huggingface.co/spaces/LiquidAI/LFM2-VL-WebGPU) 

Hugging Face   

**RELEASES:** 

- [Inertia.js 3.0](https://inertiajs.com/) – Glue between React, Vue and Svelte SPAs and non-JS server-side frameworks like Laravel, Rails and Django. [More on v3 here.](https://laravel.com/blog/inertiajs-v3-is-now-in-beta)
- [Node.js March 24, 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/march-2026-security-releases) - Including [Node.js v25.8.2 (Current)](https://nodejs.org/en/blog/release/v25.8.2), [v24.14.1 (LTS)](https://nodejs.org/en/blog/release/v24.14.1), [v22.22.2 (LTS)](https://nodejs.org/en/blog/release/v22.22.2), and [v20.20.2 (LTS)](https://nodejs.org/en/blog/release/v20.20.2).
- [TanStack DB 0.6](https://tanstack.com/blog/tanstack-db-0.6-app-ready-with-persistence-and-includes) – Now with persistence, offline support, and hierarchical data.
- [Astro 6.1](https://astro.build/blog/astro-610/), [Mantine 9.0](https://mantine.dev/changelog/9-0-0/), [Ky 2.0 Prerelease](https://github.com/sindresorhus/ky/releases/tag/v2.0.0-0), [CKEditor 48.0](https://github.com/ckeditor/ckeditor5/releases/tag/v48.0.0), [pnpm 10.33](https://github.com/pnpm/pnpm/releases/tag/v10.33.0)  

📖 Articles and Videos 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/xiqo1c9nlcnj9gh3bhiz.jpg)](https://willybrauner.com/journal/signal-the-push-pull-based-algorithm)  

[Signals: The Push-Pull Based Algorithm](https://willybrauner.com/journal/signal-the-push-pull-based-algorithm) — A well-diagrammed ground-up explanation of how [signals](https://preactjs.com/blog/introducing-signals/) work internally, focusing on the push-pull algorithm at the core of reactivity in frameworks like Solid, Vue, and Angular. 

Willy Brauner   

🖼️ [Your Options for Preloading Images with JavaScript](https://macarthur.me/posts/preloading-images/) — _“There are a number of ways to preload an image on demand with JavaScript, each with their own strengths and drawbacks. Let's explore them.”_ 

Alex MacArthur   

▶[Stop Guessing Where Your Next.js App Broke](https://youtube.com/playlist?list=PLOwEowqdeNMqf3dArAE-Mo4rVR7T2Vanr&si=tQ_vlQ4bzm_w2MXF) — 7 videos on error monitoring, replays, tracing, and alerts to debug across your Next.js stack. [Watch now](https://youtube.com/playlist?list=PLOwEowqdeNMqf3dArAE-Mo4rVR7T2Vanr&si=tQ_vlQ4bzm_w2MXF). 

Sentry sponsor   

[A Gentle Intro to npm Workspaces (With Visuals)](https://wasp.sh/blog/2026/03/25/gentle-intro-npm-workspaces) — [Workspaces](https://docs.npmjs.com/cli/v8/using-npm/workspaces) let you manage multiple packages in one repo and link local packages so they can import each other by name. npm may then hoist and deduplicate compatible dependencies during install. 

Carlos Precioso   

📄 ['I Decompiled the White House's New App'](https://blog.thereallo.dev/blog/decompiling-the-white-house-app) – Among the surprises in the React Native app are a cookie/paywall bypass injector and dynamic loading of JavaScript from a random user’s GitHub Pages... Thereallo 

📄 [Building a Scroll-Reactive 3D Gallery with Three.js, Velocity, and Mood-Based Backgrounds](https://tympanus.net/codrops/2026/03/09/building-a-scroll-reactive-3d-gallery-with-three-js-velocity-and-mood-based-backgrounds/) Houmahani Kane 

📄 [Why We Replaced Node.js with Bun for 5x Throughput](https://trigger.dev/blog/firebun) Nick at Trigger  

🛠 Code & Tools 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/wr8dtkzww9icxfo8kpoi.jpg)](https://simonwillison.net/2026/Mar/29/pretext/)  

[Pretext: A Multiline Text Measurement and Layout Library](https://simonwillison.net/2026/Mar/29/pretext/) — Cheng Lou, formerly a React core team member, caused a stir with [this X post](https://x.com/_chenglou/status/2037713766205608234) three days ago, racking up 22M impressions and getting 25k stars on [this repo](https://github.com/chenglou/pretext) since. Why? People are _very_ excited about the potential for real time web layouts! There are [demos here](https://chenglou.me/pretext/) if you want to see what the excitement is about, although the library itself is reasonably straightforward. 

Cheng Lou   

[GitHub Actions 🤝Expo CI/CD Workflows](https://try.expo.dev/js-weekly-workflows) — Keep GitHub Actions. Add Expo Workflows for mobile: M4 Pro builds, E2E tests, OTA. Let each tool handle what it’s best at. 

Expo sponsor   

[Knip v6: The Tool to Declutter Your JS/TS Projects](https://knip.dev/blog/knip-v6) — [Knip](https://knip.dev/) is a _go-to_ tool for finding and removing unused files, exports, and dependencies in projects. v6 integrates _oxc_ for 2-4x performance gains (it tears through _Astro_ in two seconds) and is largely a drop-in upgrade. 

Lars Kappert   

📺 [ArtPlayer: A Modern, Full-Featured HTML5 Video Player](https://github.com/zhw2590582/ArtPlayer) — A straightforward way to get your own heavily-customizable YouTube-style player experience. There’s [a full, live demo/playground](https://artplayer.org/) showing it off. 

Harvey Zhao   

[Semiotic 3.0: React + D3 Data Visualization Framework](https://semiotic.nteract.io/) — Does the basics well, but has some more unique offerings like [choropleth maps](https://semiotic.nteract.io/charts/choropleth-map/), [Sankey diagrams](https://semiotic.nteract.io/charts/sankey-diagram), [flow maps](https://semiotic.nteract.io/charts/flow-map), and [violin plots](https://semiotic.nteract.io/charts/violin-plot), plus streaming data support. 

nteract   

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/wvpr78nmzpjjo73nyorf.jpg)](https://github.com/williamtroup/Heat.js)  

- [Heat.js 5.1](https://github.com/williamtroup/Heat.js) _(above)_ – Generate heat maps, charts, and statistics to visualize date-based activity. Now with point/line chart support.
- [numpy-ts 1.2](https://github.com/dupontcyborg/numpy-ts/releases/tag/v1.2.0) – NumPy implementation for TypeScript and JavaScript. Now at ~50% native performance and with Float16 support. ([Homepage](https://numpyts.dev/))
- [ts-blank-space 0.8](https://github.com/bloomberg/ts-blank-space) – Pure JavaScript type-stripper using the TypeScript 6 parser.
- [RxDB 17.0](https://rxdb.info/releases/17.0.0.html) – Reactive NoSQL database for JS apps with local-first capabilities.
- [filesize.js 11.0.15](https://filesizejs.com/) – Converts byte counts into human-readable file size strings.
- 💳 [React Stripe.js 6.0](https://github.com/stripe/react-stripe-js) – Components for Stripe.js and Stripe Elements.
- [css-select 7.0](https://github.com/fb55/css-select) – CSS selector compiler and engine. Now ESM.
- [ESLint Markdown Plugin 8.0](https://github.com/eslint/markdown) – Lint Markdown with ESLint.      

📰 Classifieds   

⚡[Nimbalyst](https://nimbalyst.com/?utm_source=cooperpress&utm_medium=newsletter&utm_campaign=javascript-weekly&utm_content=primary-mar2025): Visual workspace for building with Claude Code & Codex. Manage sessions & tasks. Visually edit markdown, mockups, diagrams, code. 

--- 

[Gauntlet AI Live Night School](https://us06web.zoom.us/webinar/register/WN_GqPSYgDcRn6mkQjOnK3uTA#/registration?utm_source=javascript_weekly&utm_campaign=march_31_ad&utm_content=nightschool) - Stop Shipping Slop: How to Verify AI Generated Code for Production Deployments (Virtual - 4/1)    

📢 Elsewhere in the ecosystem 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/xcilxcd2tfzp8xwakvba.jpg)](https://blog.jetbrains.com/idea/2026/03/js-ts-free-support/)  

- JetBrains' Java/Kotlin IDE _IntelliJ IDEA_ now [includes core JavaScript and TypeScript features for free](https://blog.jetbrains.com/idea/2026/03/js-ts-free-support/) (no _Ultimate_ subscription needed).
- Vercel explains [the work going on to make Next.js work better across cloud platforms.](https://nextjs.org/blog/nextjs-across-platforms) The _Adapter API_ provides a way for platforms to adjust apps to suit their environment. OpenNext, Netlify, Cloudflare, AWS Amplify, and Google Cloud are all on board.
- 🤖 GitHub has announced, starting late April, data (including inputs and snippets) from Free/Pro/Pro+ Copilot users [will be used, by default, to help train future AI models](https://github.blog/news-insights/company-news/updates-to-github-copilot-interaction-data-usage-policy/). You can opt out.
- 🤖 A developer noticed [Copilot edited an 'ad' into one of his PRs!](https://notes.zachmanson.com/copilot-edited-an-ad-into-my-pr/) GitHub's Martin Woodward [explained (on _X_) why it happened](https://x.com/martinwoodward/status/2038612131084464521) and said the 'feature' has been disabled.
- 🔠 Looking for a new IDE font option? [CodingFont](https://www.codingfont.com/) lets you find your ideal choice _visually_ using a bracket-style faceoff. _Noto Sans Mono_ won for me – not one I'd considered before!         

Published by [Cooperpress](https://cooperpress.com/) and edited by [Peter Cooper](https://twitter.com/cooperx86) 

'JavaScript' is a trademark of Oracle Corporation in the US
We are not endorsed by or affiliated with Oracle. 

[Change your email address](https://javascriptweekly.com/edit_subscription/*|UID|*) or [stop getting this newsletter](https://javascriptweekly.com/leave/*|UID|*). 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom