Post Mortem: axios NPM supply chain compromise

Re:Post Mortem: axios NPM supply chain compromise by dgellow on Friday April 03, 2026 @08:49AM (#47626093)

npm process to setup OIDC is way too frustrating. There is just so much friction. You need the package to first exists in the registry, meaning you have to first create an API token and push something. And only then can you enable OIDC for that specific package. After adding the repo + workflow names, you have to save. Then finally toggle the “only allow OIDC publishing”.

Before each action you need to enter your 2fa code.

I got so frustrated with npm end of last year that I wrote a whole guide covering that issue: https://npmdigest.com/guides/npm-trusted-publishing

[ Parent | on HN ]

Re:Post Mortem: axios NPM supply chain compromise by mcintyre1994 on Saturday April 04, 2026 @04:24AM (#47637074)

You’re right, but a colleague recently showed me this CLI for it: https://docs.npmjs.com/cli/v11/commands/npm-trust

Still needs to be published first, but looks like it automates all the annoying UI things you mentioned.

[ Parent | on HN ]

Re:Post Mortem: axios NPM supply chain compromise by dgellow on Sunday April 05, 2026 @04:00AM (#47647186)

Oh that’s neat! Thank you for sharing!

[ Parent | on HN ]