Why EDR and proxy won't save you from supply chain malware

EDR and proxy tools were built for a different threat model and provide no meaningful protection against supply chain malware, because malicious code arriving through npm install looks like normal behavior and executes with full developer permissions. The article highlights the axios package compromise affecting roughly 100M weekly downloads in March 2026 and the durabletask Python package compromise as examples of supply chain attacks that bypass both EDR and proxy defenses.