Supply Chain Attack - Axios npm Package Compromised
Basically, hackers tricked a popular software library into spreading malware.
A major supply chain attack has compromised the Axios npm package, affecting millions of applications. Users are at risk due to malicious versions published in a short time frame. Immediate action is needed to secure systems and prevent exploitation.
What Happened
On March 31, 2026, the widely used Axios npm package was compromised in a supply chain attack. This JavaScript library, essential for making HTTP/S requests, is included as a dependency in millions of applications. Between approximately 00:21 and 03:30 UTC, attackers published malicious versions (axios@1.14.1 and axios@0.30.4) using a compromised maintainer account. These versions included a harmful dependency, plain-crypto-js@4.2.1, which contained a postinstall script functioning as a remote access trojan (RAT).
Once installed, the script executed automatically, connecting to a command-and-control server to deploy malicious payloads on various operating systems, including macOS, Windows, and Linux. The attackers had pre-staged their efforts by creating a throwaway npm account and publishing a decoy package to lend credibility to their malicious versions.
Who's Affected
The impact of this attack is extensive due to the popularity of the Axios library. Organizations that utilize npm packages in their CI/CD pipelines may have inadvertently pulled these malicious versions into their build environments during the three-hour window. Even systems that did not directly install Axios could be affected if other packages depended on the compromised versions, highlighting a significant downstream risk across the modern JavaScript ecosystem. This incident follows closely on the heels of the recent TeamPCP supply chain campaign, although there is currently no evidence linking the two events.
Tactics & Techniques
The attackers employed a multi-step approach to execute their plan. They created a legitimate-looking decoy package to mask their malicious intent, which allowed them to publish the harmful versions without raising immediate suspicion. The use of a remote access trojan indicates a sophisticated level of planning, as it allows attackers to maintain control over compromised systems. This method of attack underscores the vulnerabilities inherent in software supply chains, where a single compromised package can have far-reaching implications.
Defensive Measures
To mitigate the risks associated with this incident, organizations should take immediate action. First, revert to known safe versions of Axios: axios@1.14.0 for 1.x users or axios@0.30.3 for 0.x users. Ensure that all packages are sourced from the official npm registry and verify their integrity using npm's built-in package hashes. Additionally, clear caches, lockfiles, and any CI/CD artifacts that may have pulled the malicious versions, followed by a complete reinstallation of dependencies in a clean environment.
Lastly, all credentials that may have been exposed during this compromise should be rotated immediately. By taking these steps, organizations can significantly reduce their exposure to this threat and enhance their overall security posture.