Axios npm Package Compromised - Supply Chain Attack Unveiled

What Happened

On March 31, 2026, two malicious versions of the Axios npm package, a widely used JavaScript HTTP client, were briefly published to npm. These versions, 1.14.1 and 0.30.4, were uploaded via a compromised maintainer account. They contained a hidden dependency that deployed a cross-platform remote access trojan (RAT) to any machine that ran npm install during a two-hour window. The malicious packages were removed shortly after being detected, but the damage was already done for those who downloaded them.

The attack was not a case of a rogue dependency or typosquatting. Instead, the attacker gained direct publishing access to the official Axios package on npm. By adding a malicious dependency, plain-crypto-js@4.2.1, to the package.json of the new releases, they ensured that anyone who installed the affected versions would inadvertently execute a script that compromised their system.

Who's Being Targeted

The risk is particularly high for developers and CI/CD pipelines that do not pin their dependency versions. If your system ran npm install or npm update during the three-hour window when the malicious packages were live, you could be affected. Additionally, projects depending on other compromised packages, such as @qqbrowser/openclaw-qbot or @shadanai/openclaw, are also at risk, regardless of the time frame.

The malicious payload was designed to work across multiple operating systems, including macOS, Windows, and Linux. Each platform had a specific RAT that could execute arbitrary commands and communicate with a command and control server, making this a serious threat for many users.

Signs of Infection

If you suspect that your system may have been compromised, there are several indicators to look for. Each operating system has specific files and processes that can signal an infection:

• macOS: Look for a binary at /Library/Caches/com.apple.act.mond.
• Windows: Check for a PowerShell binary at %PROGRAMDATA% t.exe masquerading as Windows Terminal.
• Linux: Inspect for a Python script located at /tmp/ld.py.

Additionally, keep an eye out for outbound connections to the command and control server at sfrclak.com:8000, as this could indicate active communication from a compromised machine.

How to Protect Yourself

If you are a user of the Axios package, immediate action is necessary. First, audit your lockfiles for the affected versions and rotate any secrets that may have been exposed. You can use tools like Snyk to check for vulnerabilities in your projects.

To mitigate risks, consider the following steps:

1. Pin Axios to a known safe version in your package.json. Any version other than 1.14.1 or 0.30.4 is safe.
2. Commit your lockfile and ensure that your CI/CD pipeline uses npm ci to maintain integrity.
3. Implement security measures such as blocking the malicious plain-crypto-js dependency in your package manager.

By taking these precautions, you can significantly reduce the risk of falling victim to similar supply chain attacks in the future.