Industry
Technology and SaaS
Hijacked build tools, poisoned packages, stolen developer logins and leaked keys at software companies, and the rules that apply.
Read more
Significant cyber incident
Axios npm package compromise
On 31 March 2026, two malicious versions of the Axios JavaScript library (1.14.1 and 0.30.4) were published to the npm registry through the lead maintainer's compromised account.
In short
On 31 March 2026, two malicious versions of the Axios JavaScript library (1.14.1 and 0.30.4) were published to the npm registry through the lead maintainer's compromised account. Each added a hidden dependency, plain-crypto-js, that installed a remote access trojan on macOS, Windows and Linux. The versions were live for about three hours before npm removed them. CISA and Singapore's CSA told affected users to rotate credentials.
What happened
On 31 March 2026, two malicious versions of Axios, 1.14.1 and 0.30.4, were published to the npm registry. The Axios maintainer says they were published through his compromised account. Singapore’s CSA calls Axios a widely used JavaScript HTTP client.
Both versions added a dependency called plain-crypto-js 4.2.1. It installed a remote access trojan on macOS, Windows and Linux. The versions were live for about three hours before npm removed them.
The maintainer says the attacker got into his computer through a targeted social engineering campaign and malware, and then used his npm credentials to publish.
Timeline
-
About two weeks before 31 March 2026
A social engineering campaign starts against the lead Axios maintainer, according to his post mortem.
-
2026-03-27
Axios 1.14.0, the last clean 1.x release before the attack, is published to npm.
-
2026-03-30 05:57 UTC
plain-crypto-js 4.2.0 is published to npm.
-
2026-03-30 23:59 UTC
plain-crypto-js 4.2.1 is published, according to the npm registry record.
-
2026-03-31 00:21 UTC
axios 1.14.1 is published with plain-crypto-js 4.2.1 injected.
-
2026-03-31 about 01:00 UTC
axios 0.30.4 is published with the same payload. The npm registry records 01:00 UTC.
-
2026-03-31 about 01:00 UTC
Community members file issues. The attacker deletes them with the compromised account.
-
2026-03-31 01:38 UTC
An Axios collaborator opens a pull request to deprecate the versions and contacts npm.
-
2026-03-31 03:15 UTC
The malicious Axios versions are removed from npm.
-
2026-03-31 03:29 UTC
plain-crypto-js is removed from npm, according to the maintainer.
-
2026-03-31 04:26 UTC
npm publishes a security holding package under the plain-crypto-js name, according to the npm registry record.
-
2026-03-31
GitHub publishes a malware advisory for axios 1.14.1 and 0.30.4.
-
2026-04-01
Singapore's Cyber Security Agency publishes an advisory.
-
2026-04-20
CISA publishes its alert with guidance for organizations.
How the attack worked
Step 1: Reach the maintainer
The maintainer says the attacker posed as the founder of a company, using a cloned identity. He was invited to a Slack workspace branded for that company and then to a meeting on MS Teams that showed what looked like a group of people.
Step 2: Install the malware
In the meeting he was told something on his system was out of date. He installed the missing item, thinking it was part of Teams. He says that item was the remote access trojan.
Step 3: Publish from the stolen account
The maintainer says the attacker used his npm credentials to publish. He says he had 2FA on the account. The npm registry shows that 1.14.1 and 0.30.4 were published on 31 March, hours after an earlier version of plain-crypto-js appeared on 30 March. Singapore’s CSA describes a CI/CD pipeline bypass in the attack.
Step 4: Run code at install time
The Axios releases carried one new dependency, plain-crypto-js 4.2.1. CISA says it downloads multi-stage payloads from attacker infrastructure, including a remote access trojan. CSA says the payload runs from a post-install script. That is why CISA advises setting ignore-scripts=true.
Step 5: Call home and persist
CSA lists a command and control domain, sfrclak[.]com, and file traces on each system: a macOS cache file, wt.exe and a script on Windows, and /tmp/ld.py on Linux.
Who says who was behind it
No public attribution. None of the government and official pages opened (CISA, Singapore CSA, GitHub, npm, the Axios maintainer's post mortem) names an actor.
Impact
No source opened gives a count of affected organizations, installs or confirmed victims. GitHub says any computer with axios 1.14.1 or 0.30.4 installed should be treated as fully compromised. CISA and Singapore CSA tell affected users to rotate credentials. CSA says Axios users worldwide were affected. The maintainer says the versions were live for about three hours. He gives the window as 00:21 to 03:15 UTC on 31 March. The maintainer's own devices were wiped and all his credentials were reset.
Government and regulator response
- 31 March 2026: An Axios collaborator opened a pull request to deprecate the versions and contacted npm. npm removed the malicious Axios versions at 03:15 UTC and the plain-crypto-js dependency at 03:29 UTC, according to the maintainer.
- 31 March 2026: GitHub published a malware advisory for axios 1.14.1 and 0.30.4. It says to treat any computer with the package as fully compromised and rotate secrets from another computer.
- 31 March 2026: npm put a security holding package in place of plain-crypto-js.
- 1 April 2026: Singapore’s Cyber Security Agency published an advisory with indicators of compromise and steps to remediate.
- April 2026: The maintainer published a post mortem. He wiped all his devices, reset all credentials, and listed immutable releases, OIDC publishing and updated GitHub Actions as fixes.
- 20 April 2026: CISA published an alert. It advises downgrading to axios 1.14.0 or 0.30.3, rotating credentials, blocking the attacker domain, using phishing-resistant MFA, and setting ignore-scripts=true and min-release-age=7 in .npmrc.
Lessons
-
One maintainer account can reach millions of projects
The attack worked by publishing from a single maintainer account. Users who trusted the package name got the malware.
-
Install scripts run before anyone looks
The payload ran at install time, so CISA advises turning install scripts off with ignore-scripts=true.
-
Publishing from a personal account is a risk
The maintainer says this could have been avoided, and he is moving to OIDC publishing and immutable releases.
-
Detection depended on people
The maintainer says detection depended on the community noticing. Community members filed issues first.
-
2FA on the account was not enough
The maintainer says he had 2FA on and the attacker still published, after his machine was infected. CISA asks for phishing-resistant MFA.
-
A waiting period helps
CISA recommends min-release-age=7 so brand new package versions are not installed straight away.
What to check in your own organization
-
Search your lockfiles
Look in package-lock.json, yarn.lock, pnpm-lock.yaml and bun.lock for axios 1.14.1, axios 0.30.4 or plain-crypto-js.
-
Check CI runs from 31 March
Review pipelines and developer machines that ran npm install or npm update on 31 March 2026, and caches in your artifact repositories.
-
Hunt for the known traces
Search for connections to sfrclak[.]com and 142[.]11[.]206[.]73, and for the file traces CSA lists on macOS, Windows and Linux.
-
Rotate what was exposed
For any affected machine or CI run, rotate VCS tokens, CI/CD secrets, cloud keys, npm tokens and SSH keys.
-
Turn off install scripts
Set ignore-scripts=true in .npmrc and test what breaks. Add min-release-age=7.
-
Protect developer accounts
Require phishing-resistant MFA on developer and maintainer accounts. Brief staff on fake meeting invites that ask them to install an update.
-
Alert on odd child processes
Watch for unexpected child processes and network calls during npm install, and for dependencies that suddenly run commands.
Questions
What happened to Axios?
On 31 March 2026, two malicious versions, 1.14.1 and 0.30.4, were published to npm through the lead maintainer's compromised account. They added a dependency that installed a remote access trojan.
How long were the bad versions live?
About three hours. The maintainer says they were removed at 03:15 UTC after being published from 00:21 UTC.
Am I affected?
Only if you installed axios 1.14.1 or 0.30.4. The maintainer says the bad versions were live from 00:21 to 03:15 UTC on 31 March.
What should I do if I installed it?
CISA says to downgrade to axios 1.14.0 or 0.30.3, delete node_modules/plain-crypto-js, and rotate exposed credentials. GitHub says to treat the machine as fully compromised.
Who was behind it?
No public attribution appears in the government and official pages opened for this entry.
How did the attacker get in?
The maintainer says a fake company approached him, and a meeting prompted him to install a missing item, which was the remote access trojan.
In our research
Sources
- Supply Chain Compromise Impacts Axios Node Package Manager CISA
- Advisory on Axios Supply Chain Attack via Compromised npm Account Cyber Security Agency of Singapore
- Post Mortem: axios npm supply chain compromise (Issue 10636) Axios project on GitHub
- Post Mortem issue comments (maintainer's description of the approach) Axios project on GitHub
- Malware in axios (GHSA-fw8c-xr5c-95f9) GitHub Advisory Database
- axios package record npm registry
- plain-crypto-js package record npm registry
- [SECURITY] axios@1.14.1 compromised (Issue 10630) Axios project on GitHub
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.