You can mitigate similar attacks by editing your .npmrc

min-release-age=7 # days
ignore-scripts=true

I always advocate switching to pnpm where install scripts are disabled by default. It has plenty of security features to ward off most supply chain attacks.

• https://pnpm.io/settings#onlybuiltdependencies
• https://pnpm.io/settings#minimumreleaseage
• https://pnpm.io/blog/2025/12/29/pnpm-in-2025#security-by-default

Doesn't seem to have been live for very long.

I was trying to figure out why people still use Axios, when the built-in fetch works just fine. Is it because people are still sending XML requests?

I was reading through the thread, and it looks like the package mangers have implemented an option that says "only install package versions that are X minutes/days old". The idea is NPM has had time to act before your package manager installs that new version.

Really sophisticated attack