The malicious packages were live for roughly two to three hours before npm pulled them down, but in that narrow window thousands of developer machines, CI/CD pipelines, and production build servers likely executed the payload. Security researchers quickly attributed the attack to a suspected North Korean threat actor (tracked as UNC1069), known for sophisticated supply-chain operations aimed at cryptocurrency theft and espionage.
This incident is not a traditional vulnerability in Axios code. It is a classic account takeover that turned the library’s own installation process into a malware delivery mechanism. The attack bypassed GitHub Actions CI/CD protections, left almost no trace in the Axios source itself, and self-erased after execution—making detection extraordinarily difficult even for vigilant teams.
Background: Why Axios Matters
Axios has become the de facto standard for making HTTP requests in Node.js and browser environments since its release in 2014. It powers everything from frontend React apps to backend microservices, cloud automation scripts, and enterprise SaaS platforms. Its promise-based API, automatic JSON handling, and interceptors make it far more ergonomic than the native fetch API for many developers. With adoption spanning startups, Fortune 500 companies, and government systems, Axios sits at the foundation of modern JavaScript infrastructure—the “plumbing” of the web, as Bloomberg described it.
Because it is so deeply embedded, any compromise ripples instantly across the ecosystem. Unlike application-layer bugs that affect a single product, a supply-chain attack on Axios threatens the entire dependency graph of millions of projects.
Timeline of the Attack
The operation was meticulously staged:
- March 30, 05:57 UTC: A throwaway npm account (nrwise@proton.me) publishes plain-crypto-js@4.2.0—a clean decoy that simply copies the legitimate crypto-js library.
- March 30, 23:59 UTC: The same account updates to plain-crypto-js@4.2.1, now containing a malicious postinstall script.
- March 31, 00:21 UTC: The compromised jasonsaayman npm account (email changed to ifstap@proton.me) publishes axios@1.14.1.
- March 31, 01:00 UTC: axios@0.30.4 follows, targeting both the active 1.x and legacy 0.x branches to maximize reach.
- March 31, ~03:15 UTC: npm detects the issue, unpublishes the malicious Axios versions, and later places a security hold on plain-crypto-js.
The attacker used a stolen long-lived npm access token and published directly via the npm CLI, completely bypassing the project’s OIDC-signed GitHub Actions pipeline. The malicious releases had no corresponding Git tags or commits—another red flag that went unnoticed during the brief publication window.
What Exact Vulnerability and Exposure?
There was no code vulnerability inside Axios itself. Every file in the malicious packages except package.json was identical to the clean 1.14.0 and 0.30.3 releases. The only change was the addition of one line in dependencies:
"plain-crypto-js": "^4.2.1"Crucially, plain-crypto-js was never imported or referenced anywhere in Axios source code. Its sole purpose was to run a postinstall hook the moment npm install (or equivalent in Yarn, pnpm, Bun, etc.) completed.
The setup.js dropper inside plain-crypto-js@4.2.1 was heavily obfuscated with XOR encryption and base64 encoding. Once executed, it:
- Detected the operating system (darwin/macOS, win32/Windows, or Linux/other).
- Contacted the live command-and-control server at http://sfrclak.com:8000/6202033.
- Downloaded and executed platform-specific second-stage payloads.
- Performed anti-forensic cleanup: deleted itself, swapped the malicious package.json with a clean decoy (package.md renamed to package.json reporting version 4.2.0), and ensured npm install exited with code 0 so the developer saw nothing suspicious.
Exposure window: Any machine or CI runner that ran npm install (or npm ci, yarn install, etc.) between approximately 00:21 and 03:15 UTC on March 31, 2026, and resolved to axios@1.14.1 or axios@0.30.4, executed the RAT. Because Axios is so common, this includes developer laptops, shared build servers, Docker images rebuilt during that period, and any automated dependency updates.
Indicators of Compromise (IOCs):
- Malicious package shasums (verify against these).
- Files: /Library/Caches/com.apple.act.mond (macOS), %PROGRAMDATA%\wt.exe (Windows), /tmp/ld.py (Linux).
- Network: outbound connections to sfrclak.com (IP 142.11.206.73).
The RAT harvested credentials, established persistence, and phoned home—classic espionage tooling. Google’s Threat Intelligence Group linked the macOS payload to WAVESHAPER, a backdoor previously tied to North Korean actors.
Remedies?
Immediate actions for every team:
- Audit lockfiles now: Search package-lock.json, yarn.lock, pnpm-lock.yaml, and CI build artifacts for axios@1.14.1, axios@0.30.4, or plain-crypto-js@4.2.1.
- Pin safe versions:
- npm install axios@1.14.0 (1.x users)
- npm install axios@0.30.3 (0.x users) Add overrides/resolutions in package.json to prevent transitive resolution:
JSON{ "overrides": { "axios": "1.14.0" }, "resolutions": { "axios": "1.14.0" } } - Remove malicious artifacts: rm -rf node_modules/plain-crypto-js and reinstall with --ignore-scripts.
- Assume compromise if affected: Treat any machine that installed the bad versions as fully breached. Rebuild from known-good images, rotate all credentials (cloud keys, API tokens, database passwords, npm tokens, GitHub secrets, SSH keys) that were accessible from the affected environment.
Longer-term hardening (essential for every organization):
- Enable npm 2FA and use granular access tokens (never long-lived classic tokens for publishing).
- Mandate OIDC Trusted Publishers for all open-source projects instead of manual npm logins.
- Run CI/CD with --ignore-scripts by default and use tools like Socket, Snyk, or StepSecurity to scan for suspicious postinstall hooks.
- Implement dependency pinning, lockfile auditing in CI, and SBOM (Software Bill of Materials) generation.
- Monitor for the listed IOCs and block the C2 domain/IP at the firewall level.
- Educate developers: Never run npm install blindly on untrusted or automatically updated dependencies, especially at night or on weekends when response times are slower.
npm and the Axios maintainers responded swiftly once alerted via GitHub issue #10604. The malicious versions were unpublished, the compromised account suspended, and a security-holder stub placed on plain-crypto-js. Yet the speed of the attack underscores how fragile single-point-of-failure maintainer accounts remain.
Broader Implications
This is not the first npm supply-chain attack, nor will it be the last. It echoes SolarWinds, Codecov, and the 2024 xz-utils backdoor, but with a crucial difference: Axios is used by every JavaScript developer, not just a niche segment. The self-erasing RAT and phantom dependency represent a new level of stealth.
North Korean actors have repeatedly targeted cryptocurrency and developer tooling because successful infections yield high-value credentials at scale. The Axios compromise could have handed them access to corporate clouds, payment systems, and internal APIs across thousands of organizations.
The lesson is clear: open-source security is only as strong as its weakest maintainer account. Projects must adopt modern publishing hygiene—short-lived tokens, OIDC signing, automated dependency scanning, and multi-maintainer review. Developers and companies must treat dependencies as part of their attack surface, not trusted black boxes.
Conclusion
The Axios hack of March 31, 2026, will likely be remembered as a watershed moment in JavaScript security. In just three hours, a single compromised credential turned one of the web’s most trusted libraries into a malware vector that could have infected millions of machines. Thanks to rapid detection and response, the damage was contained—but the exposure window was real, and the cleanup will take weeks.
Every developer and security team should run their audits today. Pin the safe versions, rotate secrets aggressively, and push your organization toward supply-chain resilience. The internet runs on open source; it is time we secured it like the critical infrastructure it truly is.
