Zetema
ζήτημα
Problems
Challenges
Sources
Builders
Manifesto
Share a problem
Problems
Challenges
Sources
Me
Edit problem
The problem, in one line
What happens
On 31 March 2026 two malicious axios versions were published to npm from a compromised maintainer account and were live for about 3 hours. The Yarn issue says earlier axios releases carried provenance attestations but the malicious ones were published without it, a detectable drop in trust. It asks for an option such as trustPolicy: no-downgrade that refuses a version whose trust level is lower than earlier versions of the same package.
Who it touches
Where
Field
Technology & Software
Healthcare & Wellness
Education
Fisheries & Aquaculture
Ocean & Marine
Oil, Gas & Energy
Mining & Natural Resources
Construction & Trades
Transportation & Logistics
Tourism & Hospitality
Restaurants & Food Services
Retail & E-commerce
Agriculture & Food Production
Manufacturing
Housing & Real Estate
Government & Public Services
Legal Services
Finance & Insurance
Arts, Culture & Entertainment
Nonprofits & Community Services
Personal & Everyday Life
Other
Not sure
Institution
(optional)
Photos
(optional)
0 of 6 · first one is the cover
Add photo
Camera or library
A photo of what you see helps people recognise it.
Save changes