NEWS

Critical npm Supply Chain Attack Impacts Widely Used JavaScript Library

A critical software supply chain attack has compromised the popular Axios package on npm, exposing developers and organizations worldwide to potential system…

On March 31, 2026, a significant cybersecurity incident was identified involving the npm ecosystem, where attackers successfully compromised the maintainer account of the widely used Axios library.

The attackers published malicious versions of the package (axios@1.14.1 and axios@0.30.4), embedding a hidden dependency designed to execute malware upon installation. Given Axios’ extensive global usage across web applications, APIs, and enterprise systems, the incident presents a high-impact supply chain risk.

Nature of the Attack

The incident is classified as a software supply chain attack, where trusted software was weaponized to distribute malicious code.

Key characteristics of the attack include:

Compromised maintainer account used to publish malicious package versions

Injection of a rogue dependency: plain-crypto-js@4.2.1

Use of npm’s post-install scripts to execute malicious code automatically

Deployment of a cross-platform Remote Access Trojan (RAT) targeting Windows, Linux, and macOS systems

Communication with attacker-controlled command-and-control (C2) infrastructure

Notably, the malicious code was not embedded directly in Axios itself but delivered through a dependency, making detection significantly more difficult.

Timeline of Events - March 30, 2026: Malicious dependency prepared and staged - March 31, 2026 (00:21–01:00 UTC): Compromised Axios versions published

Despite the short exposure window, automated CI/CD pipelines and development environments may have unknowingly installed the compromised versions.

Impact Assessment

This incident carries high global risk due to:

- Axios’ massive adoption (tens of millions of weekly downloads) - Automatic execution of malicious scripts during installation - Potential compromise of: Developer workstations CI/CD pipelines Production systems - Risk of credential theft, API key exposure, and remote system control

_Organizations that installed affected versions should treat this as a confirmed breach, not a theoretical vulnerability._