Immediate Status: SAFE

3mpwrApp is completely safe from the axios supply chain attack.

On March 27-31, 2026, the popular npm package axios was compromised through a maintainer account takeover. We immediately verified our dependencies and confirmed:

  • Using axios 1.13.6 (safe version from February 27, 2026)
  • NO compromised versions in dependency tree
  • plain-crypto-js typosquatting attack: NOT present
  • All user data and app functionality: SECURE

What Happened

  • Compromised: axios 1.14.0, 1.14.1, 0.30.4
  • Attack Vector: Maintainer account compromise (jasonsaayman)
  • Also Affected: plain-crypto-js 4.2.1 (typosquatting attack)
  • Current Status: Compromised versions still marked as “latest” on npm (as of March 31)

Our Response

  1. Immediate verification - Confirmed no compromised packages
  2. Paused npm install - All installations frozen until all-clear
  3. Created security runbook - Emergency response procedures
  4. Built verification tools - Safe package checking scripts
  5. Socket.dev ready - Supply chain monitoring configured and ready to deploy

When Will It Be Safe?

Timeline Estimate:

  • Optimistic: 24-48 hours (April 1-2)
  • Realistic: 3-5 days (April 3-5)
  • Conservative: 1 week (April 7)

Waiting for:

  1. axios team unpublishes compromised versions
  2. jasonsaayman account secured/revoked
  3. Official all-clear from axios project

Monitor: bash npm view axios@latest version

Safe when: != 1.14.0, != 1.14.1, != 0.30.4

For Users: NO ACTION REQUIRED

Your data is safe. The app is not affected. Continue using 3mpwrApp normally.

For Developers: ALL WORK HALTED

  • ALL development operations paused until all-clear
  • Do NOT run npm install or npm update
  • Stress testing delayed - May shift by up to 2 weeks
  • Use existing node_modules (verified safe)
  • Run: powershell -File scripts/safe-package-verify.ps1
  • Review: docs/SECURITY_INCIDENT_RESPONSE.md

We refuse to touch the npm ecosystem while compromised packages are marked as “latest”. Your security > our timeline.

Known Issue: Firebase Crash Notification

We received a crash report from Firebase Crashlytics on March 31, 2026:

Fatal Exception: Property ‘trackEvent’ doesn’t exist

This analytics tracking error will be resolved once axios is resolved and we can safely update dependencies. The crash does not affect core app functionality or data securityit’s a non-critical analytics issue that requires npm package updates to fix.

Impact: Analytics tracking may fail in some edge cases until we can deploy the fix (estimated April 3-5).

Long-term Protection

Socket.dev supply chain monitoring is configured and ready to deploy:

  • Real-time compromise detection
  • Typosquatting alerts
  • Install script monitoring
  • Publisher reputation tracking

This will activate as soon as it’s safe to run npm install.

Resources

Report Security Issues

Email: empowrapp08162025@gmail.com Response Time: Within 48 hours

Stay safe. Verify your dependencies. Monitor your supply chain.

Last Updated: March 31, 2026