This repository has implemented protections against the Axios npm supply chain compromise (CVE related to malicious versions 1.14.1 and 0.30.4).

Current Protections:

• Lifecycle/build scripts are restricted under pnpm — only explicitly allow-listed build scripts run, and pnpm install --ignore-scripts skips them entirely
• pnpm audit is the dependency audit tool (run before merging dependency changes)
• Renovate manages dependency updates with vulnerabilityAlerts enabled
• Catalog pinning in pnpm-workspace.yaml / root package.json locks shared dependency versions across all workspaces
• This repo uses pnpm, not bun — CI fails on any bun.lock artifact; the lockfile is pnpm-lock.yaml

Review Date: May 2, 2026 (30 days from implementation)

1. Manual Review Required: All dependency updates must be manually reviewed
2. Renovate Managed: Renovate opens PRs for updates; minor bumps are never auto-merged
3. Security Audits: Run pnpm audit before merging dependency changes
4. Lock File: Always commit lock file changes with dependency updates

DO NOT open a public GitHub issue for security vulnerabilities.

1. Email security concerns to the repository maintainers
2. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if available)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Resolution: Critical vulnerabilities addressed within 14 days

1. Immediate Actions:

   • Stop all CI/CD pipelines
   • Isolate affected systems
   • Do NOT run npm install, pnpm install or bun install until verified

2. Assessment:

   • Check for malicious package versions in node_modules
   • Review CI/CD logs for suspicious activity
   • Scan for indicators of compromise (IOCs)
   • Check network logs for C2 connections

3. Remediation:

   • Rotate all secrets and credentials exposed to affected systems
   • Remove and reinstall dependencies from clean state
   • Update pinned versions to known-safe releases
   • Review and update override configurations

4. Recovery:

   • Verify all systems are clean before resuming operations
   • Document incident and lessons learned
   • Update security measures based on findings

Malicious Axios Versions:

• axios@1.14.1
• axios@0.30.4

Malicious Dependency:

• plain-crypto-js@4.2.1

C2 Infrastructure:

• Domain: sfrclak[.]com
• IP: 142.11.206[.]73
• Port: 8000
• URL: hxxp://sfrclak[.]com:8000/6202033

Malicious Files:

• Windows: %TEMP%\6202033.vbs, %TEMP%\6202033.ps1, %PROGRAMDATA%\system.bat, C:\ProgramData\wt.exe
• macOS: /Library/Caches/com.apple.act.mond
• Linux: /tmp/ld.py

1. Never use ^ or ~ for critical dependencies - Use exact versions
2. Review package changes - Check what changed before updating
3. Use pnpm install --ignore-scripts - When possible, skip lifecycle scripts
4. Monitor dependencies - Subscribe to security advisories
5. Rotate credentials regularly - Especially after dependency updates

1. Pin all dependencies - Use exact versions in package.json
2. Use lock files - Always commit pnpm-lock.yaml (never a bun.lock; CI rejects it)
3. Run security audits - Run pnpm audit before merging dependency changes
4. Limit permissions - Use minimal required permissions for workflows
5. Monitor logs - Review CI/CD logs for anomalies

• Microsoft Security Blog - Axios Supply Chain Attack
• npm Security Best Practices
• GitHub Security Advisories

• Implemented Axios supply chain attack protections
• Added lifecycle script blocking
• Integrated security audit into CI/CD
• Created incident response plan