Securing the npm Supply Chain: Lessons from the 2026 Axios Attack

npm Provenance and SLSA: The Supply Chain Hygiene Baseline Every Team Needs in 2026

The Axios supply chain attack of March 2026 compromised 83 million weekly downloads. It revealed that SLSA provenance attestations are useless if legacy tokens remain active in the environment.

Why This Matters

In the axios incident, the maintainers implemented SLSA Level 2 and OIDC publishing, yet a legacy classic token allowed attackers to bypass all cryptographic controls. This highlights a critical disconnect between ideal supply chain models and technical reality: npm’s authentication hierarchy prioritizes classic tokens over modern OIDC trust, meaning a single forgotten secret can invalidate an entire provenance strategy.

Key Insights

• Axios supply chain attack, 2026: Malicious versions [email protected] and [email protected] affected 83 million weekly downloads despite existing SLSA attestations.
• Authentication Precedence Concept: npm classic tokens take precedence over OIDC credentials, allowing legacy secrets to override provenance controls.
• SLSA Level 2 Compliance: Requires hosted CI platforms to generate authenticated provenance, a standard now supported natively by the npm registry.
• TeamPCP Campaign, 2026: Expanded attacks targeted LiteLLM and Telnyx by exploiting cascading trust chains and compromised CI/CD credentials.
• Behavioral Analysis Tool: LucidShark used for local SCA scans to verify network calls and filesystem patterns before package installation.

Working Examples

Hardened GitHub Actions workflow using OIDC for provenance-backed publishing.

permissions: { contents: read, id-token: write } jobs: publish: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - run: npm publish --provenance --access public

Command to verify cryptographic signatures for all packages in node_modules.

npm audit signatures

Secure installation command that enforces lockfile integrity and prevents postinstall script execution.

npm ci --ignore-scripts

Dependabot configuration for maintaining pinned GitHub Action commit SHAs.

version: 2 updates: - package-ecosystem: 'github-actions' directory: '/' schedule: interval: 'weekly'

Practical Applications

• CI/CD pipelines enforcing ‘npm audit signatures’ to block packages missing SLSA attestations. Pitfall: Using ‘npm install’ instead of ‘npm ci’, which allows unverified lockfile deviations.
• Engineering teams pinning GitHub Actions to specific commit SHAs. Pitfall: Relying on mutable tags like ‘@v4’ which can be compromised by attackers to inject malicious code.

References:

• https://dev.to/toniantunovic/npm-provenance-and-slsa-the-supply-chain-hygiene-baseline-every-team-needs-in-2026-3aoh