The Worst Hack of 2026

[00:01] This just became the most dangerous command that anyone can run. npm install anything. Fill in the blank. n a n, openclaw, doesn't matter. We're still uncovering just how bad the fallout on this is. Anyone could be infected. You

[00:13] could be infected. And this just happened. Axios, the most popular HTTP library, over 100 million downloads a week, was hijacked. A hacker took over malicious code without actually injecting malicious code, and it deploys

[00:27] a remote access Trojan in under 1.1 seconds. And the malware erases itself. No trace left behind. This just might be the most sophisticated and dangerous coffee ready. Let's dig into how this happened today. Like just a few hours

[00:40] ago. So, how exactly did this happen? Here's what we know so far. I'm going to how they got in to how the malware erased itself. And how it was discovered about this right now. Now, first, you probably have Axios installed, the thing

[00:55] version here in a moment. It's an HTTP library, and it's essentially how code install it directly. Like I've never installed Axios, but I do have it installed. How? npm install. npm is the package manager for JavaScript,

[01:10] essentially the app store for code. Devs use it a ton. And so do you if you've installed something like n a n or openclaw. But you're not just installing installing a bunch of dependencies or other code written by other people that

[01:22] the app you're installing depends on to work. You're trusting openclaw, but openclaw is trusting Axios. This is how most software works. And as it stands, the average npm project trusts 200 to 2,100 strangers with code execution. And

[01:36] because this is where we got in trouble with Axios. Axios, something that 174,000 projects depend on, is coded by a bunch of random people. I mean, here's the change log right here. Looking at the commits, random people.

[01:49] Pay attention to this guy. And these are unpaid people. This is open source. And one of those people got compromised. This guy. I feel so bad for this guy real name. Maybe it is. He's a lead maintainer for

[02:03] Axios, and the attacker got his access token, a long-lived NPM classic access the kingdom. Now, we don't know how this happened just yet. We just know that it did. And this is when things get bad. He changed his account email to this email

[02:17] address, I have [email protected]. And the attacker was really clever because he never actually added any malicious code to Axios. Instead, he added one line to the package.json file. Here it is clean. Don't blink. This is

[02:30] what he changed. plain_crypto.js. Notice dependencies. They keep getting dependency. Nothing kind of crazy about it. No one would really notice this. In fact, an average code reviewer would just go, "Oh, that's a simple

[02:44] crypto thing." And this sucker was never imported to any of Axios's 86 source files. It exists only to install its post-install script. But, the attacker was smart. They actually staged a clean version of this file 18 hours before the

[02:57] malicious one. And they were able to bypass the typical CICD pipelines by using NPM CLI, essentially skipping all the guardrails that would normally catch something like this. Now, socket.dev was the first person or the first company to

[03:09] diagram I want to show you. Oh, and also, they changed two release branches, the 1.x and 0.x. Specifically, the 1.14.1 and the 0.30.4. And they were poisoned within 39 minutes

[03:22] of each other. So, any project using a caret range of these two releases would pull the compromised version on the next NPM install, which often happens when you're just installing open clock as some YouTuber told you to do it

[03:35] during that time frame. I'm sorry. So, when you do NPM install, this by itself. You don't have to do anything. And it triggers what's called a dropper. This dropper drops in setup.js.

[03:50] But, here we have two layers of obfuscation, which hides all the dangerous stuff from static scanners. It's using XOR and base 64 and this weird order 7077 phrase. Does anyone know what that means? So, now that

[04:04] setup.js has the obfuscated all the dangerous stuff. Or revealed it, it can operating system that it's currently running on, then contact the C2 server, the command and control server, which the attacker

[04:17] operates, and downloads the specific RAT or remote access Trojan software onto look like on Mac, Windows, and Linux. This happens 1.1 seconds after npm install. And then it cleans

[04:32] up. It deletes setup.js, deletes the malicious package.json, and renames the pre-staged package.md to package.json, which is a clean version. At this point, the attacker has access to your system. They can access your stuff in 1.1

[04:45] you weren't doing anything weird or wrong. You were just installing or using software from people that you trust. It's not your fault. like this. If someone wanted to poison me, they could just put poison in this

[04:59] cup of coffee, but that'd be hard cuz I'm always watching my coffee. roaster and poison the beans I buy. Actually, I need some more coffee right now.

[05:26] coffee bags, the same bags that are used by all the suppliers. That would expand people. I know this analogy is kind of dark. Or What if they poisoned the water supply, going after the water

[05:41] expanded their use beyond coffee drinkers. It's everyone who uses the And that's kind of the scope we're dealing with right now with the axios if you drink the water. Because here's the thing, you might have axios

[05:54] installed, but you may not even know. I know I have it installed. I think I'm Because again, this stuff just happened. I'm kind of discovering it with you. leave now. Okay. Bye.

[06:08] Okay. Let's check. Let's open up your terminal first. Type in this. npm terminal first. Type in this. npm list -g axios. Check your versions. list -g axios. Check your versions. If you see 1.14.1 or 0.30.4,

[06:22] across your entire system. We can use this little multi-multiline command for all the systems. And it's finding things I've custom built myself. I It's everywhere, man. Now, let's check if the rat actually made it onto your

[06:36] see if it's on my Mac. Not there. I'll have commands for what Windows and Linux going to reach out to the command and control server. This is the IP that was found. It was taken down or it's not up anymore. If none of that showed

[06:52] Just keep an eye out. But if you found anything, stop right now. Don't just delete files. Treat your machine as a compromised machine. Rotate your API keys. Every credential, every token. I'll have a full remediation checklist

[07:05] the ground. And it seems like this is happening more and more often now. Um ha- AI is amazing and it's been helping us build stuff, but it's also helping the hackers do things. This is happening way more often than it should.

[07:18] So, pay attention. Be secure. Um also, go watch John Hammond's live went through all this and went through all the code. It was very fun to watch. this soon as well. And thank you to all you warriors out there. All you amazing

[07:33] people who are remediating all this stuff. This is a massive thing. A that coffee brewing. And if you're affected by this, I'd love to hear in the comments below how it's going. How How bad is it? Maybe offer some help or

[07:46] through this. That's all I got. I'll catch you guys next time. Hey, you made end of my videos I like to pray for you, my audience. I know it's kind of weird. my audience. I know it's kind of weird. Go with it. Life is weird. 1 2 3 pray.

[08:00] other side of this camera, on the other side of the screen. I ask in your name that you bless them in their lives right now. That um if they are affected by this hack that you would give them the passion and the

[08:12] strength and the ability and the diligence and the energy to just tackle this with skill. That you would bless their their own personal computing environment, their company's environment, and just ask that

[08:25] you would make them a rock star in this moment. Um if they're not affected, if they're just watching this to learn this, I pray that you would turn them into an amazing cybersecurity person. That

[08:38] them the ability to learn these skills and absorb them. To learn about about supply chain attacks, to learn how to defend against them. my audience right now that you would just give them so much favor in their

[08:52] I pray for success over their career and if there's any anxiety over anything in moving very fast, remove that anxiety. Just let it melt off of them and let them take one day at a time, learn that next thing,

[09:06] and just stay relentlessly optimistic. I ask this in your name, Jesus. Amen. All right, that's all I got. Actually, I'm going to have um going to have Pikachu try to explain supply chain attacks to you real quick.

[09:20] She begged me to let her do this. Hi. I'm Maddie Keith and today I'll like I'll be supplying supply chain attacks. The coffee?

[09:32] The The analogy I gave. >> Oh, okay. So, let's do this. The coffee explanation. So, let's say if this really bad guy wants to poison you and you have your cup of coffee. He put

[09:44] and you have your cup of coffee. He put this nice cup of warm hot coffee and he gets poison and he puts in the coffee and you drink it. Okay, but in the next explanation is if you have a coffee bag with beans

[09:59] in it, coffee beans, and but the guy with the poison puts it with the coffee coffee beans. But the really bad one

[10:11] is if the guy where like like there's all these coffee bean bags and they're all together and the guy puts poison in one of the coffee bean bags. All of the coffee bean bags then all of the other coffee bean bags get

[10:24] exposed exposed exposed. So, that's my that's the explanation. So, basically I think what's it called again? Supply chain attack. Supply chain attack is where there's a source and it goes in

[10:40] your computer and it's like I think it's like a virus, right? Yeah. It's like a virus and pretend the poison in my analogy is a virus and the coffee and the coffee bean and the

[10:53] coffee bean bags are your computers. So, yeah. That's it. Thank you.