On a Saturday morning in early April, a maintainer of one of the most downloaded JavaScript packages in the world received a video call invitation. The face on the other end looked familiar — a known colleague in the open-source community. The voice matched. The mannerisms were close enough. But the person wasn’t real.
It was a deepfake. And the goal was to steal credentials that would have given attackers publishing access to packages installed billions of times per month.
The campaign, which briefly succeeded in compromising the widely used Axios HTTP client library, represents one of the most sophisticated supply chain attacks ever attempted against the npm registry — the central repository for JavaScript and Node.js packages. It combined AI-generated video impersonation, social engineering, and targeted phishing in a coordinated assault on the maintainers of the 50 most depended-upon npm packages, as first reported by Slashdot.
The implications are staggering. A single compromised package at the top of the npm dependency tree can cascade into millions of applications — from banking platforms to medical devices to government systems. This attack didn’t just probe a theoretical vulnerability. It exploited one.
Anatomy of the Attack: Deepfakes Meet Dependency Chains
The operation targeted maintainers with surgical precision. Attackers identified the human beings behind the most critical npm packages — people whose credentials, if stolen, would grant the ability to push malicious code to a staggering number of downstream consumers. These aren’t corporate employees behind enterprise firewalls. Many are independent developers, volunteers, or small-team open-source contributors who maintain critical infrastructure in their spare time.
The attackers generated AI deepfake videos mimicking known figures in the open-source JavaScript community. These weren’t crude face-swaps. According to security researchers who analyzed the campaign, the deepfakes were high-fidelity, real-time video generations capable of sustaining short conversations. The synthetic personas were used to establish trust before directing targets toward credential-harvesting pages disguised as npm authentication portals or GitHub OAuth flows.
At least one of these attempts succeeded. The Axios library — a promise-based HTTP client used by an enormous share of JavaScript applications for making API requests — was briefly compromised. A tainted version was published to the npm registry before the breach was detected and the package restored to its legitimate state. The window of exposure was short. But in the npm world, short can be long enough. Automated CI/CD pipelines pull fresh dependencies constantly. Any system that ran an install during that window could have ingested the poisoned version.
The Axios team confirmed the incident and worked with npm’s security team at GitHub to revoke the compromised tokens, unpublish the malicious release, and audit the damage. The full scope of downstream impact is still being assessed.
This wasn’t a spray-and-pray phishing campaign. It was a sniper operation.
The selection of targets — the top 50 npm packages by dependent count — shows the attackers understood exactly how modern software supply chains work. Compromise a leaf node, and you affect one application. Compromise a root dependency, and you potentially affect everything. Packages like Axios, lodash, chalk, express, and debug sit at the foundation of millions of projects. Their maintainers are, in effect, gatekeepers of the modern web.
And many of those gatekeepers have no security team, no corporate backing, and no deepfake detection tools.
The use of real-time AI video impersonation marks a significant escalation. Social engineering attacks against open-source maintainers aren’t new — the 2024 xz Utils backdoor, in which a patient attacker spent years gaining a maintainer’s trust before inserting a backdoor into a critical Linux compression library, demonstrated how vulnerable the trust model is. But that attack required years of sustained human effort. Deepfakes compress the timeline dramatically. An attacker can fabricate trust in a single video call.
“The barrier to mass-producing convincing social engineering has collapsed,” said one security researcher familiar with the investigation, who asked not to be named because the forensic analysis is ongoing. “You used to need a human operative who could build relationships over months. Now you need a GPU cluster and a few reference videos.”
The npm Trust Problem — and Why It’s Getting Worse
npm hosts over 2.5 million packages. The registry operates on a trust model that, at its core, hasn’t fundamentally changed since its early days: if you have the credentials, you can publish. Two-factor authentication is available but not universally enforced, even for the most critical packages. GitHub, which owns npm, has been gradually tightening requirements — mandating 2FA for maintainers of high-impact packages starting in 2022 — but enforcement remains uneven, and the definition of “high-impact” doesn’t always capture every package that matters.
The problem is structural. Open-source software distribution was built on the assumption that maintainers are who they say they are, and that publishing credentials are held securely. Both assumptions are under assault.
Even with 2FA enabled, the deepfake campaign reportedly attempted to intercept time-based one-time passwords through real-time phishing proxies — tools like Evilginx that sit between the victim and the legitimate authentication server, capturing session tokens as they’re generated. This means that standard 2FA, while better than nothing, isn’t sufficient against a determined, well-resourced attacker using real-time interception.
Hardware security keys — FIDO2/WebAuthn devices — remain resistant to these relay attacks. But adoption among open-source maintainers is spotty. The keys cost money. They require setup. And for a volunteer maintaining a package in their evenings, the security posture of a Fortune 500 company isn’t a realistic expectation.
So the community faces a paradox: the most critical software infrastructure in the world is maintained by people with the least resources to defend it.
GitHub has taken steps. Its npm provenance feature, launched in 2023, allows packages to be cryptographically linked to their source repository and build process, making it harder to publish tampered code without detection. Sigstore-based signing is gaining traction. But these defenses are opt-in, and adoption curves for security tooling in open-source are notoriously slow.
The Axios compromise also raises questions about the role of AI in both offense and defense. If deepfakes can be generated cheaply enough to target dozens of maintainers simultaneously, the economics of supply chain attacks shift decisively in favor of attackers. Defenders need to detect synthetic video in real time during live calls — a capability that barely exists outside of research labs.
Some organizations are exploring “proof of humanity” verification for critical open-source actions, such as publishing a new version of a widely used package. These proposals range from biometric verification to multi-party signing requirements, where no single maintainer can push a release alone. But each adds friction to a process that open-source communities have historically resisted complicating.
The tension is real. Open source thrives on low barriers to contribution. Security thrives on barriers. Reconciling these priorities is the central challenge facing package registries, foundations like the OpenJS Foundation and the Open Source Security Foundation (OpenSSF), and the companies that depend on this code.
What Comes Next
The attack has already prompted emergency discussions within GitHub’s security team and the OpenSSF’s Supply Chain Integrity Working Group. Multiple sources indicated that npm is accelerating plans to require hardware security keys for all maintainers of packages above a certain download threshold — a policy that, if implemented, would have significantly raised the difficulty of the deepfake campaign.
But hardware keys alone won’t solve the problem. The attack surface is the human, and AI is making humans easier to fool. The xz Utils incident taught the industry that patience is a weapon. This latest campaign teaches a different lesson: speed is too.
Organizations that consume open-source packages — which is to say, virtually every organization — need to treat dependency management as a first-class security function. That means pinning dependency versions, verifying provenance where available, monitoring for unexpected package updates, and maintaining internal mirrors or caches that provide a buffer against real-time supply chain compromises. Tools like Socket, which analyzes package behavior rather than just known vulnerabilities, have gained traction precisely because the threat model has evolved beyond simple CVE tracking.
For maintainers, the message is grimmer. The person on your video call may not be a person. The email from a collaborator may not be from a collaborator. The trust networks that hold open source together are being actively targeted by adversaries with state-level or organized-crime-level resources, and the defenses available to individual maintainers haven’t kept pace.
And the deepfakes will only get better.
The Axios incident ended relatively well — the compromise was detected quickly, the malicious package version was pulled, and the blast radius appears to have been contained. But it was a proof of concept for something far larger. The next attempt may not target just 50 maintainers. It may target 500. And the next compromised package may not be caught in hours. It could sit undetected for weeks.
The JavaScript supply chain moves fast. Attackers are moving faster.
WebProNews is an iEntry Publication