One Compromised Maintainer, 174,000 Downstream Projects: The Supply Chain Math Nobody Wants to Do byManjunaathaa •July 14, 2026 On the last day of March 2026, one compromised maintainer account turned axios, one of the most widely used JavaScript libraries in the world, into a malware delivery system. The package ships roughly 100 million downloads a week and sits un…
