The case for dependency cooldowns in a post-axios world

Recent supply-chain attacks across npm, PyPI, and GitHub Actions show that rapidly consuming newly released dependencies can introduce malicious releases that propagate within hours and compromise large numbers of projects. Defensive measures such as dependency cooldowns, minimum release age settings, and tools like GuardDog, Supply-Chain Firewall, and Datadog SCA can reduce exposure but do not fully eliminate the risk. #Axios #npm

Keypoints

High-profile npm compromises (e.g., Axios) spread rapidly because a single malicious release can affect many dependent packages and millions of users.
Attackers have targeted other ecosystems too: TeamPCP used compromised credentials to publish malicious Trivy versions, and attackers released malicious LiteLLM versions on PyPI.
Npm’s scale, extensive transitive dependencies, and instant global availability make JavaScript ecosystems especially vulnerable to fast-moving supply chain attacks.
Many packages are maintained by individuals or small teams, so compromising a single account or release pipeline is often sufficient to publish malicious releases.
Semantic version ranges (e.g., ^ and ~) widen the implicit trust boundary by allowing automatic acceptance of future releases that may be attacker-controlled.
Mitigations include dependency cooldowns/min-release-age features (npm 11.10.0, Yarn/pnpm configs, Dependabot cooldowns) and detection/blocking tools (GuardDog, Supply-Chain Firewall, Datadog SCA), but each has limitations.

MITRE Techniques

[T1195 ] Supply Chain Compromise – Attackers publish malicious package releases and compromise package ecosystems to distribute malware (‘Axios is the latest in a series of compromised npm packages delivering malicious software.’)
[T1078 ] Valid Accounts – Adversaries abused compromised credentials to publish malicious versions into ecosystems and CI workflows (‘TeamPCP used compromised credentials to publish malicious versions of Trivy, which impacted both GitHub Actions workflows and Docker images.’)
[T1204 ] User Execution – Malicious code in packages is executed when dependencies are installed or picked up by CI, enabling compromise without direct manual review (‘When you install a package, you install its entire supply chain. Even if you don’t use a dependency directly, one of your other dependencies probably does.’)

Indicators of Compromise

[Package names ] compromised/ malicious package releases – Axios, Trivy, and other packages such as LiteLLM, s1ngularity, Shai-Hulud (and 2 more packages)