How I Would Have Stopped the March 2026 Axios Supply Chain Attack (Free Tool Inside)

On March 31, 2026 attackers published compromised axios packages that included a Remote Access Trojan in a transitive dependency.

The trojan exfiltrated environment variables, SSH keys, and API credentials from developers who ran npm install.

The author built 0nDefender (0nmcp), a preinstall-hook tool that scans package-lock.json to block malicious or typosquatted packages before installation.

0nDefender is free, open source, MIT licensed, and includes preinstall checks, periodic advisory scans, key health checks, and real-time alerts.