Finance & fintech
Payment rails and trading systems run on open source you did not write.
Core banking, payments, risk engines, and trading platforms are assembled from vast open-source dependency trees across Node, Python, and Java, then stitched together with custom code and AI-assisted development that pulls in still more packages. One poisoned transitive dependency can reach production in a routine build.
The software underneath
- Core banking, payments, and ledger services
- Trading, pricing, and risk engines
- Online and mobile banking applications
- Fraud, AML, and regulatory reporting systems
The axios npm compromise
March 2026Attackers stole the maintainer's npm credentials and published backdoored releases of axios, an HTTP client present in roughly 80% of code environments with around 100 million weekly downloads. The malicious versions pulled in a phantom dependency whose postinstall script ran a cross-platform remote-access trojan. Microsoft attributed it to the North Korean state actor Sapphire Sleet.
A package almost every financial app depends on became an attack vector overnight, through a dependency that had not existed the day before.
DORA
The EU Digital Operational Resilience Act has applied to financial entities since January 2025. It requires a maintained inventory of ICT providers, third-party risk assessment, and oversight of critical providers, with significant penalties for firms that fall short.
Block malicious packages before install
A phantom dependency with a postinstall payload is exactly the pattern Verifi flags and blocks at the registry layer, before it runs in your build.
Know every ICT component
Generate an SBOM of your full dependency tree to feed the provider inventory DORA expects.
Fix or gate in CI
Bump to a safe version automatically, or fail the build when there is no safe path.
Have you used Verifi in finance & fintech?
We are building our library of real-world results. Tell us how your team runs Verifi and we will help you write it up, or request a case study for your sector.