axios Compromised on NPM

Ashish Kurmi (Hacker News):

axios is the most popular JavaScript HTTP client library with over 100 million weekly downloads. On March 30, 2026, StepSecurity identified two malicious versions of the widely used axios HTTP client library published to npm: axios@1.14.1 and axios@0.30.4. The malicious versions inject a new dependency, plain-crypto-js@4.2.1, which is never imported anywhere in the axios source code. Its sole purpose is to execute a postinstall script that acts as a cross platform remote access trojan (RAT) dropper, targeting macOS, Windows, and Linux. The dropper contacts a live command and control server and delivers platform specific second stage payloads. After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection.

Carly Page:

The releases didn’t come through the project’s usual build process either. Security firm StepSecurity found that both versions were published via the compromised npm account of “jasonsaayman,” the project’s primary maintainer, who was reportedly locked out of the account while the packages were being pushed.

The attackers swapped the account’s email address for an anonymous ProtonMail inbox and pushed the infected packages manually via the npm CLI, completely bypassing the project’s GitHub Actions CI/CD pipeline and the safeguards developers tend to assume are in place.

Previously:

• NPM Supply Chain Attack

JavaScript Malware Node.js Open-source Software Programming Security

1 Comment RSS · Twitter · Mastodon

---

Leave a Comment

Name

E-mail (will not be published)

Web site

Δ