Dependency Updates: latest Is Not a Security Strategy

On March 31, 2026, North Korean state actors compromised Axios , an npm package with over 70 million weekly downloads. Any project declaring axios@^1.14.0 connected to attacker C2 infrastructure the next time npm update ran. Six weeks later, a self-propagating worm hit 42 TanStack packages . It reached Mistral AI, UiPath, and OpenAI within hours. It also carried valid SLSA provenance attestations,…