---
title: 'The Worst Hack of 2026'
source: 'https://youtube.com/watch?v=eGSsoSEppNU'
video_id: 'eGSsoSEppNU'
date: 2026-08-05
duration_sec: 660
---

# The Worst Hack of 2026

> Source: [The Worst Hack of 2026](https://youtube.com/watch?v=eGSsoSEppNU)

## Summary

This video discusses a severe supply chain attack on the popular JavaScript HTTP library, Axios, which was hijacked to deploy a remote access Trojan (RAT) within 1.1 seconds of an npm install. The attacker compromised a lead maintainer's account, added a malicious dependency, and used obfuscation to evade detection. The video provides details on how the attack occurred, how to check if you're affected, and remediation steps.

### Key Points

- **Axios Hijacked** [00:01] — Axios, the most popular HTTP library with over 100 million downloads a week, was hijacked. The attacker deployed a remote access Trojan without injecting malicious code directly, and the malware erases itself, leaving no trace.
- **How npm Works** [00:55] — npm is the package manager for JavaScript, essentially the app store for code. Installing a package like Axios also installs its dependencies, and the average npm project trusts 200 to 2,100 strangers with code execution.
- **Compromised Maintainer** [01:49] — A lead maintainer of Axios got compromised. The attacker obtained his long-lived npm classic access token, changed his account email to stop@proton.me, and used it to publish malicious versions.
- **Malicious Dependency Added** [02:17] — The attacker added a single line to package.json, adding a dependency called plain_crypto.js. This file was never imported into Axios's source code; it only existed to run a post-install script.
- **Bypassing CI/CD** [02:57] — The attacker staged a clean version of the file 18 hours before the malicious one and used npm CLI to bypass typical CI/CD pipelines, skipping guardrails that would normally catch such changes.
- **Poisoned Releases** [03:09] — Two release branches were changed: 1.x (version 1.14.1) and 0.x (version 0.30.4). They were poisoned within 39 minutes of each other, so any project using a caret range would pull the compromised version on the next npm install.
- **Dropper and Obfuscation** [03:35] — Running npm install triggers a dropper that drops setup.js. The file uses two layers of obfuscation (XOR and base64) to hide dangerous code from static scanners.
- **RAT Deployment** [04:04] — setup.js reveals the dangerous code, detects the operating system, contacts a command and control server, and downloads a specific remote access Trojan (RAT) for Mac, Windows, or Linux. This happens 1.1 seconds after npm install.
- **Self-Cleaning Malware** [04:32] — The malware cleans up by deleting setup.js, deleting the malicious package.json, and renaming a pre-staged clean package.md to package.json, leaving no trace.
- **Coffee Analogy** [05:26] — The video uses a coffee analogy to explain supply chain attacks: poisoning the water supply affects everyone, just like compromising a widely used library like Axios affects all downstream users.
- **How to Check if Affected** [06:08] — Run 'npm list -g axios' to check global installations. If you see versions 1.14.1 or 0.30.4, you may be affected. Also check for specific files and connections to the C2 server IP.
- **Remediation Steps** [06:52] — If affected, treat the machine as compromised. Rotate API keys, credentials, and tokens. Do not just delete files. Follow a full remediation checklist.
- **Increasing Attacks** [07:05] — The video notes that AI is helping hackers, and supply chain attacks are happening more often. It recommends watching John Hammond's live analysis for more details.

### Conclusion

The Axios supply chain attack is a stark reminder of the risks inherent in open-source software dependencies. It highlights the need for vigilance, regular security audits, and immediate action if compromised.

## Transcript

This just became the most dangerous command that anyone can run. npm install anything. Fill in the blank. n a n, openclaw, doesn't matter. We're still uncovering just how bad the fallout on this is. Anyone could be infected. You
could be infected. And this just happened. Axios, the most popular HTTP library, over 100 million downloads a week, was hijacked. A hacker took over malicious code without actually injecting malicious code, and it deploys
a remote access Trojan in under 1.1 seconds. And the malware erases itself. No trace left behind. This just might be the most sophisticated and dangerous coffee ready. Let's dig into how this happened today. Like just a few hours
ago. So, how exactly did this happen? Here's what we know so far. I'm going to how they got in to how the malware erased itself. And how it was discovered about this right now. Now, first, you probably have Axios installed, the thing
version here in a moment. It's an HTTP library, and it's essentially how code install it directly. Like I've never installed Axios, but I do have it installed. How? npm install. npm is the package manager for JavaScript,
essentially the app store for code. Devs use it a ton. And so do you if you've installed something like n a n or openclaw. But you're not just installing installing a bunch of dependencies or other code written by other people that
the app you're installing depends on to work. You're trusting openclaw, but openclaw is trusting Axios. This is how most software works. And as it stands, the average npm project trusts 200 to 2,100 strangers with code execution. And
because this is where we got in trouble with Axios. Axios, something that 174,000 projects depend on, is coded by a bunch of random people. I mean, here's the change log right here. Looking at the commits, random people.
Pay attention to this guy. And these are unpaid people. This is open source. And one of those people got compromised. This guy. I feel so bad for this guy real name. Maybe it is. He's a lead maintainer for
Axios, and the attacker got his access token, a long-lived NPM classic access the kingdom. Now, we don't know how this happened just yet. We just know that it did. And this is when things get bad. He changed his account email to this email
address, I have stop@proton.me. And the attacker was really clever because he never actually added any malicious code to Axios. Instead, he added one line to the package.json file. Here it is clean. Don't blink. This is
what he changed. plain_crypto.js. Notice dependencies. They keep getting dependency. Nothing kind of crazy about it. No one would really notice this. In fact, an average code reviewer would just go, "Oh, that's a simple
crypto thing." And this sucker was never imported to any of Axios's 86 source files. It exists only to install its post-install script. But, the attacker was smart. They actually staged a clean version of this file 18 hours before the
malicious one. And they were able to bypass the typical CICD pipelines by using NPM CLI, essentially skipping all the guardrails that would normally catch something like this. Now, socket.dev was the first person or the first company to
diagram I want to show you. Oh, and also, they changed two release branches, the 1.x and 0.x. Specifically, the 1.14.1 and the 0.30.4. And they were poisoned within 39 minutes
of each other. So, any project using a caret range of these two releases would pull the compromised version on the next NPM install, which often happens when you're just installing open clock as some YouTuber told you to do it
during that time frame. I'm sorry. So, when you do NPM install, this by itself. You don't have to do anything. And it triggers what's called a dropper. This dropper drops in setup.js.
But, here we have two layers of obfuscation, which hides all the dangerous stuff from static scanners. It's using XOR and base 64 and this weird order 7077 phrase. Does anyone know what that means? So, now that
setup.js has the obfuscated all the dangerous stuff. Or revealed it, it can operating system that it's currently running on, then contact the C2 server, the command and control server, which the attacker
operates, and downloads the specific RAT or remote access Trojan software onto look like on Mac, Windows, and Linux. This happens 1.1 seconds after npm install. And then it cleans
up. It deletes setup.js, deletes the malicious package.json, and renames the pre-staged package.md to package.json, which is a clean version. At this point, the attacker has access to your system. They can access your stuff in 1.1
you weren't doing anything weird or wrong. You were just installing or using software from people that you trust. It's not your fault. like this. If someone wanted to poison me, they could just put poison in this
cup of coffee, but that'd be hard cuz I'm always watching my coffee. roaster and poison the beans I buy. Actually, I need some more coffee right now.
coffee bags, the same bags that are used by all the suppliers. That would expand people. I know this analogy is kind of dark. Or What if they poisoned the water supply, going after the water
expanded their use beyond coffee drinkers. It's everyone who uses the And that's kind of the scope we're dealing with right now with the axios if you drink the water. Because here's the thing, you might have axios
installed, but you may not even know. I know I have it installed. I think I'm Because again, this stuff just happened. I'm kind of discovering it with you. leave now. Okay. Bye.
Okay. Let's check. Let's open up your terminal first. Type in this. npm terminal first. Type in this. npm list -g axios. Check your versions. list -g axios. Check your versions. If you see 1.14.1 or 0.30.4,
across your entire system. We can use this little multi-multiline command for all the systems. And it's finding things I've custom built myself. I It's everywhere, man. Now, let's check if the rat actually made it onto your
see if it's on my Mac. Not there. I'll have commands for what Windows and Linux going to reach out to the command and control server. This is the IP that was found. It was taken down or it's not up anymore. If none of that showed
Just keep an eye out. But if you found anything, stop right now. Don't just delete files. Treat your machine as a compromised machine. Rotate your API keys. Every credential, every token. I'll have a full remediation checklist
the ground. And it seems like this is happening more and more often now. Um ha- AI is amazing and it's been helping us build stuff, but it's also helping the hackers do things. This is happening way more often than it should.
So, pay attention. Be secure. Um also, go watch John Hammond's live went through all this and went through all the code. It was very fun to watch. this soon as well. And thank you to all you warriors out there. All you amazing
people who are remediating all this stuff. This is a massive thing. A that coffee brewing. And if you're affected by this, I'd love to hear in the comments below how it's going. How How bad is it? Maybe offer some help or
through this. That's all I got. I'll catch you guys next time. Hey, you made end of my videos I like to pray for you, my audience. I know it's kind of weird. my audience. I know it's kind of weird. Go with it. Life is weird. 1 2 3 pray.
other side of this camera, on the other side of the screen. I ask in your name that you bless them in their lives right now. That um if they are affected by this hack that you would give them the passion and the
strength and the ability and the diligence and the energy to just tackle this with skill. That you would bless their their own personal computing environment, their company's environment, and just ask that
you would make them a rock star in this moment. Um if they're not affected, if they're just watching this to learn this, I pray that you would turn them into an amazing cybersecurity person. That
them the ability to learn these skills and absorb them. To learn about about supply chain attacks, to learn how to defend against them. my audience right now that you would just give them so much favor in their
I pray for success over their career and if there's any anxiety over anything in moving very fast, remove that anxiety. Just let it melt off of them and let them take one day at a time, learn that next thing,
and just stay relentlessly optimistic. I ask this in your name, Jesus. Amen. All right, that's all I got. Actually, I'm going to have um going to have Pikachu try to explain supply chain attacks to you real quick.
She begged me to let her do this. Hi. I'm Maddie Keith and today I'll like I'll be supplying supply chain attacks. The coffee?
The The analogy I gave. >> Oh, okay. So, let's do this. The coffee explanation. So, let's say if this really bad guy wants to poison you and you have your cup of coffee. He put
and you have your cup of coffee. He put this nice cup of warm hot coffee and he gets poison and he puts in the coffee and you drink it. Okay, but in the next explanation is if you have a coffee bag with beans
in it, coffee beans, and but the guy with the poison puts it with the coffee coffee beans. But the really bad one
is if the guy where like like there's all these coffee bean bags and they're all together and the guy puts poison in one of the coffee bean bags. All of the coffee bean bags then all of the other coffee bean bags get
exposed exposed exposed. So, that's my that's the explanation. So, basically I think what's it called again? Supply chain attack. Supply chain attack is where there's a source and it goes in
your computer and it's like I think it's like a virus, right? Yeah. It's like a virus and pretend the poison in my analogy is a virus and the coffee and the coffee bean and the
coffee bean bags are your computers. So, yeah. That's it. Thank you.