Summary

On March 30-31, 2026, attackers published malicious versions of the popular axios HTTP client library to npm. With over 100 million weekly downloads, axios is one of the most widely used JavaScript packages in the ecosystem.

The compromised versions—[email protected] and [email protected]—were live for approximately 2-3 hours before npm removed them. If you installed either version during that window, your system may have been compromised.

What Happened

The attacker compromised the npm account of a lead axios maintainer (jasonsaayman) and published two malicious releases targeting both the modern 1.x and legacy 0.x branches.

The attack was sophisticated:

• No malicious code in axios itself—the poisoned releases inject a fake dependency called [email protected]
• The malicious dependency runs a postinstall script that deploys a cross-platform Remote Access Trojan (RAT)
• Payloads were pre-built for macOS, Windows, and Linux
• After execution, the malware deletes itself and replaces its package.json with a clean version to evade detection

Timeline (UTC)

Time	Event
Mar 30, 05:57	Attacker publishes clean decoy [email protected] to establish history
Mar 30, 23:59	Malicious [email protected] published with RAT dropper
Mar 31, 00:21	[email protected] published (compromised)
Mar 31, 01:00	[email protected] published (compromised)
Mar 31, ~03:15	npm unpublishes both malicious axios versions
Mar 31, 04:26	npm publishes security placeholder for plain-crypto-js

How to Check If You Are Affected

Run these commands in your project directory:

# Check your installed axios version
npm list axios

# Check for the malicious dependency
ls node_modules/plain-crypto-js 2>/dev/null && echo "⚠️ POTENTIALLY COMPROMISED" || echo "✅ Not affected"

# Check package-lock.json for evidence
grep -l "plain-crypto-js" package-lock.json && echo "⚠️ Check your lock file"

If plain-crypto-js exists in your node_modules, assume compromise. This package is not a dependency of any legitimate axios version.

What to Do If Compromised

1. Isolate the affected machine from your network immediately
2. Do not trust the version number reported by npm list—the malware spoofs it to show 4.2.0 instead of 4.2.1
3. Rotate all credentials that were accessible from the compromised machine (API keys, SSH keys, tokens)
4. Audit CI/CD pipelines—if your build ran during the attack window, assume your build environment was compromised
5. Check for persistence mechanisms—the RAT may have established backdoor access
6. Update to clean versions: [email protected] or [email protected]+ when available

Why This Attack Is Significant

This wasn not opportunistic—it was precision-engineered:

• The malicious dependency was staged 18 hours in advance
• Three platform-specific payloads were pre-built
• Both release branches (1.x and 0.x) were poisoned within 39 minutes
• All artifacts were designed to self-destruct
• The malware called home within 2 seconds of npm install—before npm finished resolving dependencies

According to StepSecurity, who discovered the attack, this is “among the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package.”

Lessons for Development Teams

1. Pin exact versions in production (1.14.0 not ^1.14.0)
2. Use lockfiles and commit them to version control
3. Enable npm audit in your CI/CD pipeline
4. Monitor for OIDC publish signatures—the malicious release lacked the trusted publisher attestation that legitimate axios releases have
5. Consider tools like StepSecurity Harden-Runner that detect anomalous network activity during builds

Current Status

As of March 31, 2026:

• ✅ Malicious axios versions have been unpublished
• ✅ plain-crypto-js replaced with npm security placeholder
• ✅ Latest safe axios version: 1.14.0 (or 1.14.2+ when released)

StepSecurity is hosting a community town hall on April 1st at 10:00 AM PT to discuss the incident.

References

• StepSecurity Full Analysis
• axios on npm