I didn’t feel ready when I said yes to speaking at EmpowHER! — Sketching Visions, Building Futures.

Honestly? I’m not sure I ever feel ready. And I’m starting to think that’s the whole point.

There’s this quiet lie we tell ourselves — that we need to arrive somewhere first before we’re allowed to start. That we need a title, a credential, a moment where everything finally clicks into place and someone hands us a permission slip to take up space. I spent a long time waiting for that moment. I’m done waiting.

The rooms that asked me to earn my voice twice.

I’ve been in rooms where my ideas needed a louder voice behind them before they were taken seriously. Rooms where I was the youngest person, the only woman, the one who “didn’t look like” what leadership was supposed to look like. And for a while, I internalized that. I worked harder, spoke less, and convinced myself that visibility was something I had to earn rather than something I was already worthy of.

But here’s what I know now:

that feeling — imposter syndrome, self-editing, shrinking — it doesn’t disappear after graduation. It doesn’t vanish when you get the job, the role, or the stage. It just changes shape.

The difference isn’t that I stopped feeling it. The difference is that I stopped letting it make decisions for me.

I built communities not because I had it figured out, but because I cared enough to start.

When I got involved with AWS User Group BuildHers+, I wasn’t an expert. I was someone who kept noticing the same gap — women and LGBTQIA+ folks in tech who were brilliant, capable, and quietly underestimated. I didn’t have all the answers. I just had enough conviction to show up and try.

And that’s how most meaningful things begin, I think. Not with certainty. With care.

The sessions I’ve helped organize, the mentors I’ve watched show up for students they’d never met, the women who come up after talks and say I thought I was the only one who felt that way — none of that happened because I waited until I was fully formed. It happened because I started anyway.

What “becoming” actually looks like.

Becoming isn’t linear. It’s not a ladder you climb rung by rung until you reach some final, polished version of yourself. It’s messier and more interesting than that.

It looks like delivering a talk on imposter syndrome while quietly battling your own. It looks like building a mentorship program when you still have your own mentors you lean on. It looks like writing a caption, drafting remarks, crafting a space — and wondering the whole time if it’s good enough — and then showing up anyway.

You are not a before. You’re not waiting in a lobby until you become someone worth listening to. You are already in motion. Already building. Already becoming.

The table doesn’t have to be given to you.

This is the line I keep coming back to. Not because it’s defiant — though sometimes defiance is exactly what’s needed — but because it’s true.

If the room doesn’t have space for you, you can build the room. If the conversation isn’t happening, you can start it. If the people around you don’t see what’s possible, you can create the proof.

You don’t need to feel ready. You don’t need to have all the answers. You don’t need a perfect plan or a flawless track record or someone else’s validation before you begin.

You just need to start.

To every woman who’s been talked over and showed up anyway. To every student who walked into a room full of “experienced” people and stayed. To everyone who’s ever felt like they were building in the dark — you are not alone, and your work matters.

The table doesn’t have to be given to you.

Build it.

To the AWS Cloud Club – HUGO team of TUP Manila:

Thank you. Genuinely.

Being invited to speak at EmpowHER! — Sketching Visions, Building Futures was one of those moments I didn’t expect to sit with me as long as it did. But here I am, still thinking about the energy in that room, and it’s entirely because of the space you created.

To the event chairladies, Charlote and Zendy — the way you lead is the kind of leadership that makes people feel like they belong before they even introduce themselves. You didn’t just organize an event. You built something that mattered. And I was so honored to be a small part of it.

I came to share a story, but I think I left with more than I brought. That’s the mark of a community that’s doing something right.

Keep building! The tech space is better because you’re in it.

If you made it to the end of this — thank you. Really. It means more than you know.

And if something here resonated with you, if you’re somewhere in the middle of your own becoming and you have questions about the industry, corporate life, what it actually looks like to navigate tech as a woman or someone who’s ever felt like they didn’t quite fit — I want you to know my door is open.

If you’d like to be mentored, need someone to think out loud with, or just want a safe space to ask the questions you’re afraid sound too small or too big — reach out. No agenda, no pressure. Just an honest conversation between people trying to figure it out together.

I can’t promise I have all the answers. But I promise I’ll show up for you the same way I wish someone had shown up for me.

Find me on LinkedIn. I’d love to hear from you. 🩷

The Incident

On March 31, 2026, a high-profile supply chain attack targeted Axios, a critical HTTP client for the JavaScript ecosystem. By hijacking a maintainer’s NPM account, attackers injected a malicious dependency, plain-crypto-js, which deployed a cross-platform Remote Access Trojan (RAT).

Incident Summary

Technical Deep Dive

The attack bypassed standard security audits by hiding the malicious logic within a sub-dependency. Once installed via a standard npm install, the payload scanned the host machine for:

• Environment Variables: .env files and active shell exports.
• Auth Tokens: ~/.npmrc and ~/.aws/credentials.
• SSH Keys: Unprotected private keys in ~/.ssh.

Data was exfiltrated via POST requests to the sfrclak.com Command & Control (C2) server.

Remediation & Verification

To ensure a development environment is sanitized, the following protocol was executed:

1. Network Sinkholing: Manually mapping the C2 domain to 127.0.0.1 in /etc/hosts to prevent further exfiltration and “kill” the phone-home capability.

2. Lockfile Audit: Scanning all local projects for traces of the malicious package using a space-safe search:

   find . -type f ( -name "package-lock.json" -o -name "yarn.lock" ) -print0 | xargs -0 grep "plain-crypto-js"
   

3. Environment Sanitization: Clearing the global NPM cache and updating tool managers (like mise) to ensure only verified versions are used moving forward.

Pro-Tip: Always use npm audit or tools like Snyk to monitor your dependency tree for “hidden” sub-dependencies that do not appear directly in your package.json.

Single agents break in boring ways. You hit context limits, tools start interfering with each other, and the more capable you try to make one agent the worse it performs on any individual task. The solution most people reach for — just make the prompt bigger — is the wrong answer.

Multi-agent systems are the right answer, but they introduce a different class of problem: coordination, trust, and failure modes that are harder to debug than a bad prompt. This post is about the architecture patterns I’ve landed on after running multi-agent systems in a homelab environment where the stakes are real (it controls actual infrastructure) but forgiving enough to experiment.

Why Split Into Multiple Agents At All?

Before getting into patterns, it’s worth being honest about the tradeoffs. Multi-agent systems are more complex. They have more failure points. Debugging a chain of three agents is significantly harder than debugging one. You only pay that cost if you’re getting something back.

The things you get back:

Specialization compounds. An agent that only does Kubernetes operations can have a tightly scoped toolset, a precise system prompt tuned for that domain, and a shorter context because it’s not carrying around unrelated knowledge. It performs better on its job than a generalist agent would.

Context windows stop being a ceiling. Long-running tasks that would overflow a single agent’s context can be broken across agents that hand off summaries. An orchestrator can spawn sub-agents, collect their results, and synthesize without any one agent seeing the full problem.

Privacy routing becomes possible. This is underrated. If you have agents with different sensitivity levels — one handling ops metrics, another handling personal calendar and email — you can route them to different models. The ops agent can call an external API. The personal agent can run on a local model that never leaves the LAN. Single-agent designs make this impossible.

Blast radius shrinks. An agent that can only read Kubernetes state cannot accidentally delete a deployment. Least-privilege is easier to enforce when you have separate agents with separate toolsets than when you’re trying to gate everything behind one prompt.

Pattern 1: Orchestrator + Specialist Workers

This is the most common pattern and the one to default to. A routing agent receives user requests, determines which specialist should handle it, and delegates.

User → Orchestrator → [SRE Agent | Dev Agent | Life Agent | ...]
                           ↓
                     Task result
                           ↓
                     Orchestrator → User

The orchestrator itself does minimal work. It doesn’t need access to kubectl or shell commands. Its job is understanding intent and dispatching. The specialists have rich toolsets and domain-specific system prompts.

In practice, this means the orchestrator’s context is almost always short. It’s not accumulating tool call results — it’s reading summaries. The specialist agents can run with full context depth on their narrow domain.

One thing I’ve learned: resist the urge to make the orchestrator smart. Every behavior you add to the orchestrator is behavior that’s harder to test, harder to attribute errors to, and harder to swap out. Keep it thin. If you find the orchestrator doing complex reasoning, that reasoning belongs in a specialist.

Pattern 2: Peer Mesh with Shared Memory

Sometimes there’s no natural hierarchical decomposition. Tasks are overlapping, agents need to share context dynamically, and a fixed orchestrator would become a bottleneck.

In this pattern, agents share a memory store (vector database, key-value store, or a message bus) and can read each other’s observations.

# Example: agent writes observation to shared store
memory:
  key: "cluster/events/2026-03-22"
  value: "Node A showing elevated memory pressure (85%)"
  tags: [infrastructure, alert, node-a]
  ttl: 3600

A different agent doing capacity planning reads this observation without being explicitly told about it. It shows up as relevant context when it queries the store.

The risk here is coordination overhead. If every agent is reading everything every other agent wrote, you get noise. The solution is good tagging and TTLs — observations should expire when they’re no longer actionable, and tags should be specific enough that agents retrieve only what’s relevant to their current task.

I’ve found this pattern works well for monitoring scenarios where multiple agents are watching different subsystems and need loose awareness of each other’s state. It works poorly when you need deterministic handoffs or when the ordering of operations matters.

Pattern 3: Specialist Router with Tool-Level Delegation

This is a refinement of Pattern 1 where instead of routing entire requests, you route at the tool level. The “orchestrator” is really a tool-use layer that resolves which backend handles which capability.

From the model’s perspective, it sees a unified tool interface:

tools = [
    {"name": "check_cluster_health", "description": "..."},
    {"name": "check_vm_status", "description": "..."},
    {"name": "get_recent_deployments", "description": "..."},
]

But behind each tool, a different MCP server or agent is handling the call. check_cluster_health hits a Kubernetes MCP server. check_vm_status calls a Proxmox API. get_recent_deployments queries a git webhook store.

The model doesn’t know or care about this separation. It just calls tools. The routing is an infrastructure concern.

This is elegant but it has a cost: you can’t use agent-specific models this way. All tool calls go through the same model. If you need different models for different domains (privacy routing, capability differences), you need Pattern 1 or 2.

Handling Trust and Permissions

This is where most multi-agent designs go wrong.

The naive approach: each agent has the permissions it needs for the worst-case operation it might ever take. The SRE agent can delete pods because sometimes it needs to. The result is every agent being over-privileged for most of what it does.

The better approach: agents run at the lowest privilege tier that handles their routine work, with explicit escalation for destructive operations.

In practice, I split agents into read-only and elevated tiers:

• Read-only agents handle monitoring, querying, and summarization. They can’t modify state. This is the right default for any agent that’s operating autonomously without human review.
• Elevated agents handle restarts, scaling, and other state changes. They require explicit user confirmation before taking action.

The confirmation pattern matters. It’s not enough to put “always ask before deleting” in a system prompt — prompts can be overridden by a sufficiently convincing in-context argument. The safer approach is to require a specific --confirm flag or equivalent that the agent itself cannot provide unprompted.

# Agent cannot self-supply this flag — user must explicitly type it
./cluster-action.sh restart-pod my-api-pod --confirm

This creates a hard check that’s outside the model’s control. The model can draft the command and present it to the user, but execution requires a human keystroke.

Communication Patterns

How agents talk to each other matters as much as what they do.

Synchronous RPC (agent calls another agent directly and waits) is simple to implement and easy to debug. It’s appropriate when the sub-task needs to complete before the orchestrator can proceed. The downside: if the sub-agent is slow or fails, the orchestrator blocks.

Async with callbacks (agent dispatches a task and moves on, gets notified on completion) is better for long-running operations. An agent that kicks off a deployment check shouldn’t sit idle while it waits. It should move to other work and process the result when it arrives.

Event-driven (agents publish events, other agents subscribe) scales the best but is the hardest to reason about. Good for situations where the producer and consumer shouldn’t know about each other. Bad when you need predictable ordering or when debugging requires tracing causality through a chain of events.

For a homelab-scale system, synchronous RPC is usually the right choice. The coordination complexity of async messaging pays off at scale, and the debugging complexity is real. Start synchronous, add async only where you have a demonstrated need.

Failure Modes to Design For

Multi-agent systems fail in ways that single agents don’t.

Cascade failures: Agent A calls Agent B which calls Agent C. C times out, B returns an error, A receives an ambiguous result. Without explicit error propagation, the orchestrator has no idea what happened. Every agent-to-agent call needs to include structured error context that survives the chain.

Context poisoning: Agent A produces a plausible-but-wrong observation that gets stored in shared memory. Every subsequent agent that reads it makes decisions based on false premises. This is why TTLs on observations matter and why memory stores should track provenance.

Prompt injection through tool results: An agent queries an external source and that source contains instructions designed to hijack the agent’s behavior. This is the multi-agent equivalent of SQL injection. Treat tool results as untrusted data. An agent that summarizes a web page shouldn’t be able to override the system prompt it received from the orchestrator.

Runaway loops: Agent A asks Agent B to do X. Agent B asks Agent A to confirm. Agent A confirms and asks Agent B to do X again. Loop detection doesn’t exist natively in most frameworks. You need explicit cycle detection or depth limits on agent chains.

Model Selection Per Agent

Not every agent needs the most capable model. This matters for cost, latency, and privacy.

A rough heuristic I’ve landed on:

Running a mix of local and remote models requires that your agent framework supports per-agent model configuration. Most do — it’s usually a one-line config change. But the architectural decision to route certain data to local inference should be made early, because it affects which agent handles which topics.

What I’d Do Differently

Start with the trust model, not the architecture. The first question should be: what can each agent do, and what requires human approval? Retrofitting permission boundaries onto an existing design is painful. Designing them in from the start is straightforward.

Invest in observability early. A single agent’s reasoning is visible in its context window. Three agents passing context between each other produces failures that are invisible without structured logging. Every agent-to-agent call should be logged with inputs, outputs, and timestamps. You will need this.

Resist the temptation to share everything. Shared memory feels like it reduces duplication. It also creates tight coupling between agents that were supposed to be independent. Before writing an observation to shared state, ask whether the consuming agent actually needs it or whether you could just pass it explicitly in the handoff.

Build the glass-break workflow before you need it. The “something is broken and I need an agent to take a destructive action right now” flow will happen. If your elevated-privilege path requires a three-step confirmation process that you haven’t tested, you will be copy-pasting commands manually at 2am. Test the whole path — including the confirmation UX — before you’re in an incident.

Multi-agent systems are worth the complexity, but the complexity is real. The patterns above aren’t theoretical — they’re the ones that held up when I actually needed them. The key insight is that agents should be as narrow as possible and as trusted as necessary: no more, no less.

Do you know the difference between radio buttons and checkboxes?

I recently ran into a few misunderstandings while using polls in Telegram with multiple selections enabled. The poll shows radio buttons even though users can select multiple options.

By default:

• Radio buttons signal single choice
• Checkboxes signal multiple choices

So when users see radio buttons, they think they can pick only one option. And that’s exactly leading to unexpected results if you create a multiple selection pool.

Users trust visual patterns more than instructions. When UI elements don’t match their expected behavior, misunderstandings are inevitable.

Clarity and consistency in UI are not optional — they directly affect how people think and act.

UI #Frontend #Telegram

You changed one line in your system prompt and broke three downstream features. No tests caught it because — let’s be honest — you don’t test your prompts.

Here are three dead-simple bash scripts I use to catch prompt regressions before they hit production.

Script 1: The Golden Output Test

This script sends a fixed input to your prompt and diffs the output against a known-good response.

#!/bin/bash
# test-golden.sh — Compare prompt output against golden file

PROMPT_FILE="$1"
INPUT_FILE="$2"
GOLDEN_FILE="$3"

ACTUAL=$(cat "$PROMPT_FILE" "$INPUT_FILE" | 
  curl -s https://api.openai.com/v1/chat/completions 
    -H "Authorization: Bearer $OPENAI_API_KEY" 
    -H "Content-Type: application/json" 
    -d @- <<EOF
{
  "model": "gpt-4o-mini",
  "messages": [
    {"role": "system", "content": "$(cat $PROMPT_FILE)"},
    {"role": "user", "content": "$(cat $INPUT_FILE)"}
  ],
  "temperature": 0
}
EOF
  | jq -r '.choices[0].message.content')

echo "$ACTUAL" > /tmp/prompt-test-actual.txt

if diff -q "$GOLDEN_FILE" /tmp/prompt-test-actual.txt > /dev/null 2>&1; then
  echo "✅ PASS: Output matches golden file"
else
  echo "❌ FAIL: Output diverged"
  diff --color "$GOLDEN_FILE" /tmp/prompt-test-actual.txt
  exit 1
fi

Usage:

./test-golden.sh prompts/summarize.txt fixtures/input-1.txt fixtures/expected-1.txt

When to use: After any prompt edit. Set temperature: 0 for deterministic output. Update the golden file intentionally when you want the output to change.

Script 2: The Keyword Gate

Sometimes you don’t need exact match — you just need the output to contain (or NOT contain) specific terms.

#!/bin/bash
# test-keywords.sh — Assert required/forbidden keywords in output

PROMPT_FILE="$1"
INPUT_FILE="$2"
REQUIRED="$3"   # comma-separated: "function,return,async"
FORBIDDEN="$4"  # comma-separated: "TODO,FIXME,undefined"

ACTUAL=$(curl -s https://api.openai.com/v1/chat/completions 
  -H "Authorization: Bearer $OPENAI_API_KEY" 
  -H "Content-Type: application/json" 
  -d "{
    "model": "gpt-4o-mini",
    "messages": [
      {"role": "system", "content": $(jq -Rs . < $PROMPT_FILE)},
      {"role": "user", "content": $(jq -Rs . < $INPUT_FILE)}
    ],
    "temperature": 0
  }" | jq -r '.choices[0].message.content')

PASS=true

IFS=',' read -ra REQ <<< "$REQUIRED"
for keyword in "${REQ[@]}"; do
  if ! echo "$ACTUAL" | grep -qi "$keyword"; then
    echo "❌ Missing required keyword: $keyword"
    PASS=false
  fi
done

IFS=',' read -ra FORB <<< "$FORBIDDEN"
for keyword in "${FORB[@]}"; do
  if echo "$ACTUAL" | grep -qi "$keyword"; then
    echo "❌ Found forbidden keyword: $keyword"
    PASS=false
  fi
done

if $PASS; then
  echo "✅ PASS: All keyword checks passed"
else
  echo "--- Actual output ---"
  echo "$ACTUAL"
  exit 1
fi

Usage:

./test-keywords.sh prompts/code-review.txt fixtures/pr-diff.txt 
  "security,error handling" "looks good,LGTM"

Script 3: The Format Validator

For structured output (JSON, YAML, specific sections), validate the shape — not the content.

#!/bin/bash
# test-format.sh — Validate output structure

PROMPT_FILE="$1"
INPUT_FILE="$2"
FORMAT="$3"  # "json" | "has-headers" | "max-lines:N"

ACTUAL=$(curl -s https://api.openai.com/v1/chat/completions 
  -H "Authorization: Bearer $OPENAI_API_KEY" 
  -H "Content-Type: application/json" 
  -d "{
    "model": "gpt-4o-mini",
    "messages": [
      {"role": "system", "content": $(jq -Rs . < $PROMPT_FILE)},
      {"role": "user", "content": $(jq -Rs . < $INPUT_FILE)}
    ],
    "temperature": 0
  }" | jq -r '.choices[0].message.content')

case "$FORMAT" in
  json)
    if echo "$ACTUAL" | jq . > /dev/null 2>&1; then
      echo "✅ PASS: Valid JSON"
    else
      echo "❌ FAIL: Invalid JSON"
      echo "$ACTUAL"
      exit 1
    fi
    ;;
  has-headers)
    if echo "$ACTUAL" | grep -q "^#"; then
      echo "✅ PASS: Contains markdown headers"
    else
      echo "❌ FAIL: No markdown headers found"
      exit 1
    fi
    ;;
  max-lines:*)
    MAX="${FORMAT#max-lines:}"
    LINES=$(echo "$ACTUAL" | wc -l)
    if [ "$LINES" -le "$MAX" ]; then
      echo "✅ PASS: $LINES lines (max: $MAX)"
    else
      echo "❌ FAIL: $LINES lines exceeds max $MAX"
      exit 1
    fi
    ;;
esac

Putting It Together

I run all three in a Makefile:

test-prompts:
    ./test-golden.sh prompts/summarize.txt fixtures/doc-1.txt fixtures/expected-summary-1.txt
    ./test-keywords.sh prompts/review.txt fixtures/pr-1.txt "security,performance" "LGTM"
    ./test-format.sh prompts/extract.txt fixtures/email-1.txt json

Hook it into CI:

# .github/workflows/prompt-tests.yml
on:
  push:
    paths: ['prompts/**']
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: make test-prompts
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

Now every prompt change gets tested automatically. Total setup time: 20 minutes. Regressions caught since I started: seven.

Your prompts are code. Test them like it.

We’re going to make a claim that might sound controversial:

Uptime monitoring and website monitoring are not the same thing. Most people use the terms interchangeably. They shouldn’t.

Uptime monitoring answers: “Did the server respond?”
Website monitoring answers: “Does the site work?”

Those sound similar. They’re not. And the gap between them is where most silent failures live.

What uptime monitoring actually does

Let’s be specific about what a typical uptime monitoring tool checks. There’s no ambiguity here — this is the standard model that tools like UptimeRobot, Pingdom, Better Stack, and most others follow:

1. Send an HTTP request to your URL
2. Receive a response
3. Check the status code
4. If it’s 200 OK → mark as healthy
5. If it’s 5xx or timeout → mark as down
6. Report uptime percentage

That’s it. That’s the check.

It tells you whether your server is alive and responding to requests. It does that well. And for a long time, that was enough — because if the server was up, the site worked.

That’s no longer true.

What uptime monitoring does NOT check

Here’s a non-exhaustive list of things a standard uptime check will miss:

Asset integrity. Your HTML loads, but the JavaScript bundle it references returns 404 because you deployed and the CDN still serves old HTML pointing to deleted files. The page is a blank white screen. Status code on the document: 200.

MIME types. Your server returns a JS file with Content-Type: text/html. The browser downloads it, reads the header, silently refuses to execute it. Your SPA never boots. Status: 200.

Redirect chains. Your site redirects /page → /page/ → /page → /page/. The browser gives up after 20 hops. Your uptime tool followed the first redirect, got a 200, and moved on.

Content correctness. Someone changed your homepage in the CMS at 2am. Or your CDN started serving content from the wrong origin after a migration. The page loads — it’s just the wrong page. Status: 200.

Third-party dependencies. Stripe’s JS fails to load. Your checkout renders as an empty div. Your auth provider is down. Users can’t log in. Your page loaded fine — the broken resource is on someone else’s domain.

Regional divergence. Your site works from US-East. In Frankfurt, the CDN edge serves stale cached assets from three deploys ago. Single-region uptime checks never see this.

Every single one of these returns 200 OK. Every single one passes a standard uptime check. Every single one is broken for users.

What website monitoring checks instead

Website monitoring starts where uptime monitoring stops. Instead of asking “did the server respond?”, it asks “did the response constitute a working page?”

That means:

Treating the HTML document as a manifest, not a destination. The document is step one. Website monitoring follows up — do the JS and CSS bundles it references actually load? Do they return the right MIME types? Do they return valid status codes?

Following redirect chains to completion. Not just the first hop. The full chain. Does it resolve? Does it loop? Does it end somewhere unexpected?

Fingerprinting content over time. If the response body changes without a deployment, you want to know. Content fingerprinting with SHA-256 hashes catches silent CMS edits, CDN origin drift, and cache poisoning.

Checking from multiple regions. CDN failures are regional by nature. A site can be perfect in one location and broken in another. Website monitoring runs the full check suite from multiple geographic locations independently.

Classifying root cause. Not just “something is wrong” but “why.” Is this a deployment artifact? A CDN cache issue? A DNS drift? An application error? Root cause classification turns an alert into actionable information.

A practical comparison

Here’s the same scenario through both lenses:

Scenario: You deploy a Nuxt 3 app to Vercel. The build succeeds. But a CDN edge node in Europe still serves the previous HTML, which references app.7fb2e.js. That file was deleted in the new build.

Same site. Same moment. Completely different picture.

They’re complementary, not competing

We want to be clear about something: we’re not saying uptime monitoring is useless. It’s not. You absolutely need to know when your server is down. A 503 or a timeout is a real outage and you need to know about it immediately.

The problem is treating uptime monitoring as sufficient. It’s one layer. It catches one type of failure. The failures it misses — the “200 OK but broken” failures — are increasingly the ones that actually hurt users.

The monitoring stack for a modern web application should have both:

Uptime monitoring → Is the server alive? Is it responding? Is the infrastructure running?

Website monitoring → Does the site work? Are assets loading? Is the content correct? Does it work everywhere?

If you only have the first, you have a blind spot. And it’s the kind of blind spot where your dashboard says 99.9% uptime while your users are staring at blank pages.

This is why we built Sitewatch

Sitewatch is website monitoring. Not uptime monitoring. The distinction matters to us because it’s the entire reason the product exists.

We check asset integrity, MIME types, redirect chains, content fingerprints, and multi-region consistency. When something breaks, we classify root cause — infrastructure, application, or content delivery — and provide fix guidance tailored to your tech stack.

Every check runs a 2-of-3 retry confirmation model so you don’t get woken up at 3am for a transient CDN hiccup. Duplicate alerts are deduplicated with SHA-256 fingerprinting and a 30-minute cooldown.

Free tier for 1 site. No credit card. Takes 30 seconds: getsitewatch.com

Uptime monitoring tells you the server is alive. Website monitoring tells you the site works. They’re not the same question — and the answer to one doesn’t imply the answer to the other.

On March 31, 2026, two malicious versions of axios were published to npm: [email protected] and [email protected]. Both were live for roughly three hours before npm pulled them down. During that window, anyone who ran npm install axios could have had a Remote Access Trojan (RAT) dropped silently on their machine or CI runner, with no errors and no warnings.

This post breaks down what happened, how the attack worked, and the exact commands to check if you were affected.

What happened

The attacker compromised the npm account of the primary axios maintainer. Using stolen credentials, they published two new releases across both the 1.x and 0.x branches within 39 minutes of each other. The account’s registered email was quietly changed to an attacker-controlled ProtonMail address before the releases went out.

Here is what makes this attack stand out: there is zero malicious code inside axios itself. Both releases simply added one new runtime dependency to package.json: a package called [email protected], which had never appeared in any legitimate axios version.

When you ran npm install, npm resolved and installed that dependency automatically, which triggered its postinstall script and silently executed the dropper.

The malicious dependency: plain-crypto-js

[email protected] was staged 18 hours before the axios releases, by a separate attacker-controlled account. It masquerades as a clone of the legitimate crypto-js library, with an identical description and the real author’s name in the manifest. Visually, it looks harmless. The only difference from the real package is a single extra field in package.json:

"scripts": {
  "test": "grunt",
  "postinstall": "node setup.js"
}

That setup.js is a cross-platform RAT dropper.

What setup.js does

The dropper detects your operating system and then:

• macOS: writes an AppleScript to /tmp, executes it via nohup osascript, downloads a binary to /Library/Caches/com.apple.act.mond (named to blend in with Apple system processes), makes it executable and launches it
• Linux: fetches a Python script from the C2 server to /tmp/ld.py and runs it in the background
• Windows: copies PowerShell to %PROGRAMDATA%wt.exe (disguised as Windows Terminal), then uses a VBScript to silently fetch and execute a PowerShell payload

All of this runs in under two seconds from the moment npm install starts. The npm install itself exits with code 0 and shows no errors.

The anti-forensics layer

After launching the payload, the dropper:

1. Deletes setup.js from node_modules/plain-crypto-js/
2. Deletes the malicious package.json
3. Renames a pre-staged clean stub (package.md) to package.json, which reports version 4.2.0 with no scripts

After the swap, running npm audit reveals nothing. Running npm list plain-crypto-js shows version 4.2.0. The only reliable on-disk evidence is the existence of the node_modules/plain-crypto-js/ directory, since this package was never a dependency of any real axios release.

A note on the publish metadata

Every legitimate axios 1.x release is published via GitHub Actions with npm’s OIDC Trusted Publisher mechanism, meaning the publish is cryptographically tied to a verified workflow. [email protected] breaks that pattern entirely. There is no corresponding tag or commit in the axios GitHub repository. It was published manually using a stolen npm access token.

Am I affected?

The malicious versions were live between approximately 00:21 UTC and 03:15 UTC on March 31, 2026. If you did not run npm install (or a fresh npm ci) during that window, you were likely not hit.

Run through these steps to verify.

Step 1: Check for the malicious axios versions

npm list axios 2>/dev/null | grep -E "1.14.1|0.30.4"
grep -A1 '"axios"' package-lock.json | grep -E "1.14.1|0.30.4"

No output means you are probably fine. Any output means those versions were installed.

Step 2: Check for plain-crypto-js in node_modules

ls node_modules/plain-crypto-js 2>/dev/null && echo "POTENTIALLY AFFECTED"

If the directory exists, the dropper ran. Do not rely on the version number inside it.

Step 3: Check for RAT artifacts on the system

macOS

ls -la /Library/Caches/com.apple.act.mond 2>/dev/null && echo "COMPROMISED"

Linux

ls -la /tmp/ld.py 2>/dev/null && echo "COMPROMISED"

Windows (cmd.exe)

dir "%PROGRAMDATA%wt.exe" 2>nul && echo COMPROMISED

Step 4: Check for C2 activity in logs

grep -r "sfrclak.com" ~/.npm/_logs/ 2>/dev/null
grep "sfrclak" ~/.bash_history ~/.zsh_history 2>/dev/null

Step 5: Check your CI/CD pipelines

Review any npm install runs in GitHub Actions or other CI systems between 00:20 UTC and 03:15 UTC on March 31. Any pipeline that ran with those axios versions should be treated as compromised, and all secrets injected in that workflow should be rotated immediately.

If you got multiple projects running

for dir in ~/projects/*/; do
  if [ -f "$dir/package.json" ]; then
    result=""
    if ls "$dir/node_modules/plain-crypto-js" 2>/dev/null | grep -q .; then
      result="DROPPER FOUND"
    fi
    axios_hit=$(grep -A1 '"axios"' "$dir/package-lock.json" 2>/dev/null | grep -E "1.14.1|0.30.4")
    if [ -n "$axios_hit" ]; then
      result="$result | MALICIOUS AXIOS VERSION"
    fi
    if [ -n "$result" ]; then
      echo "⚠️  $dir → $result"
    else
      echo "✅  $dir"
    fi
  fi
done

Remediation

1. Downgrade to a safe version

# 1.x users
npm install [email protected]

# 0.x users
npm install [email protected]

2. Pin the version in your package.json

{
  "overrides":   { "axios": "1.14.0" },
  "resolutions": { "axios": "1.14.0" }
}

3. Remove plain-crypto-js and reinstall

rm -rf node_modules/plain-crypto-js
npm install --ignore-scripts

4. Block the C2 domain (macOS / Linux)

echo "0.0.0.0 sfrclak.com" | sudo tee -a /etc/hosts
sudo iptables -A OUTPUT -d 142.11.206.73 -j DROP

5. Add –ignore-scripts to your CI installs going forward

npm ci --ignore-scripts

This prevents any postinstall hook from running during automated builds, which would have stopped this attack entirely.

If you found a RAT artifact

Do not try to clean the machine in place. Rebuild from a known-good state and rotate everything that was accessible during the compromised install: npm tokens, AWS access keys, SSH private keys, cloud credentials, CI/CD secrets, and any .env values present at install time.

Indicators of Compromise

Takeaways

This attack did not require any vulnerability in axios itself. It exploited the trust developers place in a well-known package name and a familiar maintainer account. The entire weapon was a single extra line in package.json.

A few habits that would have reduced exposure here:

• Run npm ci --ignore-scripts in CI pipelines as a standing policy
• Use npm’s Trusted Publisher provenance statements to verify releases were published from the expected CI workflow
• Watch for new dependencies appearing in transitive installs that were not there before
• Pin your lockfile and review package-lock.json diffs in pull requests

The full technical breakdown, including the decoded dropper, process tree, and file swap events captured at runtime, is in the StepSecurity report.

Stay safe.