WATCHMAN'S TORCH Issue #29
Can you use artificial intelligence as an anti-virus?
// TO THE READER //
Dear privacy seekers,
It was late. A casual website of mine (of course not ETT, dear readers) needed an urgent WordPress upgrade and I was tired. The AI was right there, clean and eager to help, and I made the call that would cost me sleep. I let it handle the installation. Not blindly, I watched the Linux commands scroll past, approved what I could follow, trusted the rest. Installing a development environment isn’t like installing WordPress for a civilian. For civilians it’s complicated. For us it’s a different kind of hell — you don’t just install the thing, you install the universe around the thing.
Shortly after, a report surfaced about a supply chain attack targeting Axios, a popular JavaScript HTTP library. Compromised versions **1.14.1** and **0.30.4** had been published to npm, carrying a hidden remote access trojan capable of affecting Windows, macOS and Linux.
My immediate assumption was that I was safe. WordPress does not list Axios as a dependency. I was wrong to assume that.
A quick search confirmed Axios was present on my machine. Running one command showed exactly why:
$pnpm why axios
wordpress@1.1.1
└── wordpress/scripts@30.27.0
└── jest-dev-server@10.1.4
└── wait-on@8.0.5
└── axios@1.14.0
Five levels deep. Not an official WordPress dependency, but present regardless through the development toolchain. My installed version was **1.14.0**, one version behind the compromised release. Likely safe, but the exploit description made one thing clear: the malware deliberately replaces itself with a clean file after execution. **Absence of evidence is not evidence of absence.**
I was panicking.