erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: March 31, 2026

1 editorial brief and 14 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: axios npm compromise. Anyone whose lockfile, CI log or npx cache shows axios 1.14.1, axios 0.30.4 or plain-crypto-js, especially builds or installs run between 00:21 and 03:15 UTC on March 31, 2026.
  • Composer (PHP): 5 critical advisories (ci4-cms-erp/ci4ms, baserproject/basercms). Check with composer audit.
  • PyPI: 4 critical advisories (fastmcp, mlflow, scitokens, openssl-encrypt). Check with pip-audit (or: pip show <package>).
  • npm: 3 critical advisories (parse-server, openclaw). Check with npm audit (or: npm ls <package>).
  • Go: 2 critical advisories (github.com/siyuan-note/siyuan/kernel). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Malicious package

axios 1.14.1 and 0.30.4: npm Hijack Drops North Korean RAT

axios is everywhere, but the bad versions lived only about three hours on March 31, 2026; if nothing resolved a fresh axios in that window you are fine, and if something did, that machine ran a remote-access trojan.

Must act: Anyone whose lockfile, CI log or npx cache shows axios 1.14.1, axios 0.30.4 or plain-crypto-js, especially builds or installs run between 00:21 and 03:15 UTC on March 31, 2026.

Can relax: Projects with lockfiles pinned to clean versions and no fresh install during that window were not affected, per the axios maintainers.

  1. Search all lockfiles (package-lock, yarn.lock, pnpm-lock.yaml, bun.lock) for axios 1.14.1, 0.30.4 and plain-crypto-js
  2. Treat any host that installed them as fully compromised: isolate, rebuild from a clean image
  3. Rotate every credential present on that host or injected into affected CI jobs

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 14

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 5

Check: composer audit

PyPI 4

Check: pip-audit (or: pip show <package>)

npm 3

Check: npm audit (or: npm ls <package>)

Go 2

Check: govulncheck ./...