npm install and pray. Axios and TanStack, 2026.

Two npm supply chain attacks in early 2026: the Axios compromise by Sapphire Sleet and the Mini Shai-Hulud worm by TeamPCP. What happened, how to check if you were hit, how to harden, and an honest look at how Pent would have mitigated these.