Axios Supply Chain Attack Compromises Millions of Users

Axios, a widely used JavaScript HTTP client with over 300 million weekly downloads, has been compromised in a significant supply chain attack. Two versions of the npm package, specifically axios@1.14.1 and axios@0.30.4, were found to include a malicious dependency, plain-crypto-js@4.2.1, which serves as a remote access trojan (RAT) dropper. This attack was executed using the compromised npm credentials of Axios's primary maintainer, Jason Saayman, allowing the attacker to bypass standard security measures.

Supply chain attack hits 300 million-download Axios npm packageAxios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm AccountAxios Hack Alert: Malicious npm Versions Drop RAT on macOS, Windows, and LinuxHackers may have slipped malware into popular axios package: report

• March 30, 2026, 05:57 UTC: A clean version of plain-crypto-js@4.2.0 is published.

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

• March 30, 2026, 23:59 UTC: The malicious version plain-crypto-js@4.2.1 is published.

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

• March 31, 2026, 00:21 UTC: Axios version 1.14.1 is published, injecting plain-crypto-js@4.2.1.

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

• March 31, 2026, 01:00 UTC: Axios version 0.30.4 is published with the same malicious dependency.

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

The attacker compromised Saayman's npm account, changing the registered email to a ProtonMail address and publishing the malicious packages directly. The RAT dropper, executed via an obfuscated Node.js script, targets macOS, Windows, and Linux systems, deploying platform-specific payloads. For instance, on macOS, it installs a trojan binary disguised under Apple's cache naming conventions, while on Windows, it uses PowerShell to execute a hidden script. Linux systems receive a Python RAT silently dropped into the /tmp directory.

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm AccountAxios Hack Alert: Malicious npm Versions Drop RAT on macOS, Windows, and LinuxSupply chain attack hits 300 million-download Axios npm packageHackers may have slipped malware into popular axios package: report

Developers using the compromised Axios versions are advised to take immediate action. They should downgrade to safe versions (axios@1.14.0 or axios@0.30.3), check for specific RAT artifacts, and rotate all credentials. The potential impact of this attack is extensive, affecting frontend frameworks, backend APIs, and CI/CD pipelines.

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

Security experts have criticized the npm ecosystem's vulnerability, highlighting the ease with which attackers can exploit maintainer accounts. The attack's sophistication, including the use of a clean decoy version to establish credibility, raises concerns about the effectiveness of current security measures in preventing such incidents.

Hackers may have slipped malware into popular axios package: report

Security firms like StepSecurity and Socket have confirmed the attack's details, emphasizing the need for developers to audit their systems and CI/CD pipelines. They recommend implementing stricter security protocols to prevent similar future incidents.

Axios Hack Alert: Malicious npm Versions Drop RAT on macOS, Windows, and Linux

While the attack's details have been widely reported, there is no consensus on the identity of the attacker or their motivations. Some analysts suggest that the lack of financial gain indicates the involvement of an advanced persistent threat (APT) actor focused on intelligence gathering rather than monetary theft.

Supply chain attack hits 300 million-download Axios npm package

• “This will go down in history as one of the most successful software supply chain attacks ever,” — Open Source Malware

Supply chain attack hits 300 million-download Axios npm package

• “The addition of plain-crypto-js is unambiguous tampering.” — Socket

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

• “Neither malicious version contains a single line of malicious code inside Axios itself," StepSecurity said.” — StepSecurity

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

• “If you’ve run npm install in the past several hours, it’s worth checking your dependency files for any of the flagged versions.” — Cyber Kendra

Hackers may have slipped malware into popular axios package: report

This incident underscores the critical need for enhanced security practices in software development and package management to safeguard against future supply chain attacks.

Supply chain attack hits 300 million-download Axios npm package