# 2026 developer-stack patch check

Companion files for [Patch the 2026 developer stack in this order](/blog/developer-stack-security-2026/).

`check-lockfiles.sh` searches `package.json`, `package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`, and `pnpm-lock.yaml` for the Axios versions published on 31 March 2026 (`1.14.1` and `0.30.4`) and for `plain-crypto-js`. It reads files. It does not run npm, and it does not contact a registry.

`minimum-versions.md` is the floor list from the vendor advisories, checked 5 November 2026. Compare those versions yourself. The script does not.

## Run

Bash 3.2 or newer. macOS and Linux `find` both accept this invocation.

```bash
bash check-lockfiles.sh /path/to/repo
```

Clean tree, exit 0:

```text
clean: no axios 1.14.1, axios 0.30.4, or plain-crypto-js under /path/to/repo
```

A lockfile that contains the 31 March version prints the matching line and exits 1:

```text
/path/to/repo/package-lock.json:1:axios@1.14.1
hit: a machine that installed these versions needs its secrets rotated from a different machine.
```

The search includes `node_modules`, on purpose. The malware sits there after an install, including when the lockfile was later edited. It skips `.git` and `.terraform`.

## If it hits

1. Treat that machine, and any CI runner that installed the version, as compromised.
2. Rotate secrets from a different machine. Include npm tokens, GitHub tokens, cloud keys, and SSH keys that were present during the install.
3. Delete `plain-crypto-js` and reinstall Axios. On the 1.x line the 24 April floor is 1.15.2. Do not reinstall 1.14.1 or 0.30.4.
4. Work through `minimum-versions.md` for PHP, Node.js, and the framework you actually run.

The post explains which rows can wait. This folder does not.