# 100 Million Weekly Downloads. One Malicious npm Update. - Date: 2026-04-02 - Category: Agentics The Axios npm attack was staged over 18 hours with a decoy package to establish legitimacy. The OpenClaw ecosystem was in the blast radius. ---