{
  "video_id": "o7NYXvYohYk",
  "transcript": "If you're a JavaScript developer, I have some bad news.\nPut down your artisanal soy milk latte and find a safe space to watch this video because it will almost certainly make you cry.\nI can hardly keep it together myself because yesterday a Precision Guided Remote Access Trojan or RAT was discovered in Axios, a Library with over 100 million weekly downloads on NPM.\nFor over a decade, countless developers have turned to Axios to improve the developer experience when making HTTP requests in Node JS in the browser.\nBut now that improved developer experience just turned non consensual backdoor penetration by a magnum sized trojan.\nTwo different malicious versions of Axios were published to the NPM registry that contained a highly sophisticated supply chain attack that compromises developer machines and CI CD servers.\nIf you use Axios and are running either of these versions, the quick fix is to go into your garage, find a sledgehammer, destroy your machine, fake your own death, and then move to a remote village in the Siberian tundra.\nAnd I'm not exaggerating.\nIf your system is compromised, the RAT could already have access to your AWS credentials, your open API keys, and everything else in your env file.\nIt's a bad one, and in today's video we'll break down one of the most sophisticated NPM hacks the world has ever seen.\nIt is March 31, 2026 and you're watching the Code Report.\nOver 10 years ago Axios became extremely popular after it made HTTP requests promise based instead of callback based.\nBut now today every JavaScript runtime supports fetch natively, which in theory should have made Axios obsolete.\nYet many developers still prefer to use this third party library over the native web platform.\nUnfortun, optimizing for DX with a third party library just went horribly wrong.\nAnd the scariest thing is that Axios itself contains zero lines of bad source code.\nInstead of just hard coding a crypto miner into the package like a noob, the attacker slipped a rogue dependency into the release.\nIt triggered a post install script, pulled down a remote access Trojan from a command and control server, then wiped its own footprints so everything looked clean after the install.\nBefore we go into details though, let's take a minute to find out if you've been penetrated.\nFirst, go into your package JSON file and find out if you have either of these versions of Axios installed.\nIf you answered yes, this package may have run a post install script to install another package called Plain Crypto js.\nIt'd go into your node modules and see if you have this package installed there.\nIf your project tests positive for this package, you can then run these commands from Mac, Windows and Linux to find out if there's an actual RAT living on your machine or remote access Trojan.\nIf the RAT file is found, you are screwed.\nYour system is compromised, and simply deleting the RAT is not enough.\nYou'll want to immediately roll all API keys and tokens and follow this guide over step security for more instructions.\nBut the big question is, how did this even happen?\nWell, it starts almost the same way every other hack starts.\nThe project maintainer's NPM account was compromised.\nNormally releases are published with a GitHub action, but in the malicious versions they were published under a ProtonMail address.\nThe attacker obtained an NPM access token to publish these packages, but how they actually obtained it is unclear at this point.\nIn any case, the attacker maintained another package called plain Crypto JS that looks identical to the legitimate Crypto JS package.\nMost importantly, the bad version of this package contains a post install script that runs some JavaScript code to install the RAT on your machine.\nIt's called the RAT Dropper, and although the code was obfuscated, ISTEP Security was able to analyze it.\nThe RAT Dropper works by piggybacking on NPM install's lifecycle.\nThe script will first detect the system you're running, then reach out to a remote command and control server where it can fetch a second stage payload tailored to your operating system.\nOnce downloaded, it then writes the payload to disk, then executes it to establish remote access, at which point it can steal your credentials remotely and do all kinds of other bad stuff.\nAnd then finally, it cleans up after itself.\nTo avoid detection, it deletes itself.\nIt deletes the package JSON and removes the post install script, among other things, so that the end result is running NPM audit.\nIt doesn't raise any red flags.\nAnd that's the story of how a single NPM install turned your machine into a botnet, which really makes you appreciate rock solid platforms like Mux, the sponsor of today's video.\nTheir highly customizable API is by far the easiest way to host and stream videos in your application, but now it also gives you building blocks that let you program against your videos.\nYou can use their API and SDKs to get captions, clips and other video data to build powerful features like video search and content moderation without having to roll your own infrastructure.\nMUX also stewards the web's most popular open source video player, video JS, which just launched a fully rebuilt version 10 that's 88% smaller and a lot more modern.\nCompanies like Cursor and Patreon use Mux for all features, and the free Tier gets you 10 videos and 100,000 delivery minutes per month.\nPlus you'll get an extra $50 in credits if you sign up today@mux.com Fireship this has been the Code report.\nThanks for watching and I will see you in the next one.",
  "transcript_chars": 5559,
  "transcript_filled_at": "2026-06-15T01:16:12.402734+00:00",
  "transcript_filled_by": "groq"
}