Axios Trojans - Major npm Supply Chain Attack Uncovered
Hackers broke into the account of the person who manages Axios, a popular tool used by many apps, and uploaded fake versions that could let them control users' computers. This is a big deal because so many apps rely on Axios, and it shows how quickly problems can spread in software.
The Axios npm library was compromised in a major supply chain attack, affecting millions of applications. Organizations are urged to audit their dependencies and enhance security measures.
Attackers compromised the npm account of the lead maintainer of Axios, a widely used JavaScript HTTP client library, and used it to publish malicious versions of the package that deployed a cross-platform remote access trojan on developer machines. The incident represents the highest-impact npm supply chain attack on record, given Axios’ approximately 100 million weekly downloads and its presence in frontend frameworks, backend services, and countless enterprise applications. The malicious versions, axios@1.14.1 and axios@0.30.4, were detected by multiple security companies monitoring the npm registry within minutes of publication, triggering a rapid response that saw the malicious packages removed by the npm team within two to three hours. However, the short time window was enough to impact a significant number of developer environments. According to cloud security firm Wiz, Axios is used in 80% of cloud and code environments; the company observed execution of the malware in roughly 3% of impacted environments. The attack's significance is amplified by the fact that Axios is often included as a transitive dependency across millions of applications, meaning that even systems that did not directly install Axios could be indirectly impacted if another package depended on the compromised versions. This highlights the broader downstream risk across modern JavaScript ecosystems. The Google Threat Intelligence Group (GTIG) attributed the Axios attack to a North Korean threat actor known as UNC1069, known for their experience with supply chain attacks. "North Korean hackers have deep experience with supply chain attacks, which they’ve historically used to steal cryptocurrency," said John Hultquist, chief analyst with GTIG. The attack follows a series of supply chain attacks that impacted multiple open-source projects across different package repositories over the past several weeks, most of them attributed to a group known as TeamPCP. Researchers from security firm Snyk noted the sophistication of techniques involved in the attack, including pre-staging the malicious dependency and implementing anti-forensic self-deletion. The incident underscores the need for organizations to audit their dependencies and implement stricter security measures in their CI/CD pipelines.