In a significant security incident, two malicious versions of the popular JavaScript library axios were published on the npm platform on March 31, 2026. This breach, which lasted for approximately two hours and 53 minutes for version v1.14.1 and two hours and 15 minutes for v0.30.4, was executed using compromised credentials belonging to a lead maintainer of axios.
The attack involved the injection of a malicious package, plain-crypto-js@4.2.1, as a dependency within the compromised versions of axios. This malicious software was designed to evade detection by appearing legitimate, highlighting the sophistication of the attack. The malicious versions were swiftly removed from npm shortly after their discovery, but not before they had the potential to affect a significant number of users.
Axios is known for its extensive use in cloud and code environments, with approximately 80% of such environments utilizing the library, translating to over 100 million weekly downloads. The attack was pre-staged over an 18-hour period before the malicious versions were published, indicating a high level of planning and execution.
The malicious software included a cross-platform Remote Access Trojan (RAT) that targeted macOS, Windows, and Linux systems. Once installed, the RAT dropper executed a postinstall script that connected to a command-and-control server, potentially allowing attackers to gain unauthorized access to affected systems. Reports indicate that execution of the malicious code was observed in about 3% of the environments where the compromised versions were used.
Key moments
The attack was detected by StepSecurity through their AI Package Analyst and Harden-Runner tools, which are used to monitor and secure public repositories. According to a spokesperson from StepSecurity, “Organizations are strongly advised to audit their environments for potential execution of these versions.” This incident has raised alarms within the developer community, as it is described as one of the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package.
In response to the breach, experts have emphasized that there are “zero lines of malicious code inside axios itself,” which underscores the danger of such attacks that exploit trusted software. The attacker further complicated the situation by changing the maintainer’s account email to an anonymous ProtonMail address, making it difficult to trace the origins of the attack.
As the situation unfolds, developers and organizations are urged to remain vigilant and conduct thorough audits of their environments. The connection established by the malicious package was automatically flagged as anomalous, indicating that it had never appeared in any prior workflow run. This incident serves as a critical reminder of the vulnerabilities that can exist within widely used software libraries and the importance of maintaining robust security practices.
Details remain unconfirmed regarding the full extent of the impact on users and systems, but the swift action taken to remove the malicious versions from npm has likely mitigated further damage. As the community continues to assess the implications of this breach, the focus will be on enhancing security measures to prevent similar incidents in the future.
