The Dependency You Already Trust Is the One That Gets You

The Threat Model Most People Have Is Out Of Date

Ask a developer how they avoid malicious npm packages and you will usually hear some version of: check the download count, check the GitHub stars, avoid anything that looks misspelled.

That is a defence against typosquatting - reqeusts instead of requests, lodahs instead of lodash. It is a real category, and it is adjacent to the slopsquatting problem where an AI assistant hallucinates a package name and an attacker registers it.

It provides no protection whatsoever against the 2026 pattern, where the package is the one you meant to install, from the maintainer you meant to trust, and the malicious code arrived in a new version of it.

What Actually Happened In 2026

The axios case is the clearest illustration. The attacker reached the lead maintainer's machine through social engineering, took the npm credentials, and published [email protected] and [email protected]. Neither release contained obvious malware. Each simply added a dependency - plain-crypto-js, a typosquat of crypto-js - which downloaded and executed a cross-platform RAT on install. That dependency had been pre-staged 18 hours earlier. Not a fake package: axios, the HTTP client sitting in a large share of Node projects, including most AI-generated ones, because it is what assistants reach for by default.

@mastra followed the same shape three months later. A forgotten contributor account was hijacked and used to republish roughly 142 packages across the scope, swapping dayjs for an attacker-controlled easy-day-js. The first version of that package was clean; a later one added a post-install hook that disabled TLS verification, fetched a second stage from a raw IP address and ran a cross-platform cryptocurrency stealer. Snyk and Orca both link the tradecraft to Sapphire Sleet, also tracked as BlueNoroff - a North Korean group specialising in developer-targeted supply chain operations. This is not a hobbyist threat surface.

Note what the two have in common: the compromised package itself looked fine. The malice sat one level down, in a dependency it pulled in. Reading the diff of axios would not have saved you.

The background numbers are worth holding alongside the incidents. Sonatype's 2026 report puts the cumulative total of known and blocked malware at over 1.233 million packages across npm, PyPI, Maven Central, NuGet and Hugging Face, with more than 454,600 new malicious packages identified in 2025. Over 99% of open source malware occurred on npm.

Why This Hits AI-Generated Projects Harder

Two structural reasons, neither of which is about the code being bad.

First, dependency count. Assistants add packages freely - a date helper here, a validation library there - and a Bolt or Lovable scaffold routinely ships with 40 to 60 direct dependencies before you have written a feature. Each one is an account that can be compromised.

Second, and more important, version ranges. AI-generated package.json files are full of carets, and a caret means "give me the newest thing that is probably compatible". That is precisely the mechanism both 2026 attacks relied on: they did not need you to install anything new, only to install again during their window.

// ❌ BAD - typical AI-generated package.json
{
  "dependencies": {
    "axios": "^1.7.2",          // any 1.x - including the malicious 3-hour release
    "express": "^4.19.2",
    "zod": "^3.23.8",
    "date-fns": "latest",       // whatever is newest, whenever you install
    "lodash": "*"               // literally anything
  }
}
// No package-lock.json committed - CI resolves fresh on every build

With this file, a npm install in CI during the axios window pulls the trojan. You changed nothing. You deployed on a Tuesday like always.

How To Fix It

The defences are unglamorous and effective. None of them require you to evaluate packages more carefully.

// ✅ GOOD - exact versions, lockfile committed, CI installs from the lock
{
  "dependencies": {
    "axios": "1.7.2",           // exact - a new release cannot arrive silently
    "express": "4.19.2",
    "zod": "3.23.8",
    "date-fns": "3.6.0",
    "lodash": "4.17.21"
  }
}

// package-lock.json IS committed, and CI uses:
//   npm ci          (installs exactly the lockfile, fails if it disagrees)
// not:
//   npm install     (free to resolve something newer)

1. Commit the lockfile. It records exact resolved versions and integrity hashes. An attacker republishing a version cannot match the recorded hash. This is the single highest-value change.
2. Use npm ci in CI, never npm install. ci installs precisely what the lockfile says and fails if the manifest disagrees. install is permitted to resolve something newer - which is the entire attack path.
3. Drop * and latest entirely. They mean "install whatever is published at the moment CI happens to run".
4. Delay adoption of brand-new versions. Both 2026 windows were measured in hours to minutes. A cooling-off period on non-security upgrades removes most of the exposure.
5. Know your CVE surface. Tools like VibeDoctor's Vibe Check (vibedoctor.io) automatically scan your codebase for loose version ranges, missing lockfiles and known-vulnerable dependencies, and flag specific file paths and line numbers. Free to sign up.

What A Lockfile Does And Does Not Buy You

Worth being precise, because lockfiles get oversold.

A committed lockfile with integrity hashes means an install reproduces exactly what you previously resolved. If a version you already depend on is republished with malicious content, the hash no longer matches and the install fails loudly. That is the protection, and it is substantial.

It does not protect you when you deliberately upgrade into a compromised version, and it does not help if you regenerate the lockfile during the attack window. It narrows the exposure from "every install" to "installs where you chose to move", which is a small, deliberate, reviewable set of moments.

That is the whole game here: converting a continuous, invisible risk into an occasional, visible decision.

FAQ

Sources

• Sonatype, 2026 Software Supply Chain Report - 1.233M cumulative malicious packages, more than 454,600 new in 2025, over 99% on npm.
• Unit 42, The npm Threat Landscape: Attack Surface and Mitigations - attack mechanics and mitigation guidance.
• Datadog Security Labs, Compromised axios npm package delivers cross-platform RAT - malicious versions, the plain-crypto-js dependency and the three-hour window.
• axios post-mortem, issue #10636 - the maintainers own account of the compromise.
• Snyk, A forgotten contributor account compromised the entire Mastra npm package scope - the 88-minute campaign and the Sapphire Sleet attribution.
• Orca Security, Mastra npm supply chain attack - package count and easy-day-js payload behaviour.