Today, March 31, 2026, the popular npm package axios was compromised via a compromised maintainer account. Malicious versions were released that install a Remote Access Trojan (RAT).
📦 Affected versions
- axios@1.14.1 (Current branch)
- axios@0.30.4 (Legacy branch)
The malware hides in a new dependency called plain-crypto-js@4.2.1. This executes a postinstall-Script that immediately attempts to steal secrets (keys, .env, SSH).
Official Sources and Analyses
- Snyk Security Blog:
Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT - Huntress Labs
(Technische Tiefenanalyse): Supply-Chain Compromise of axios npm Package - Malwarebytes Labs:
Axios supply chain attack chops away at npm trust
Interesting Videos for this Supply Chain Attack on Youtube:
NetworkChuck
From NetworkChuck - A Git hosted Guide for Checks!
Axios npm Supply Chain Attack — Detection & Protection Guide
https://github.com/theNetworkChuck/axios-attack-guide
The Legend John Hammond
2hr Live Session
Stay Safe Guys!
