Axios Supply Chain Attack (March 2026)

Today, March 31, 2026, the popular npm package axios was compromised via a compromised maintainer account. Malicious versions were released that install a Remote Access Trojan (RAT).

📦 Affected versions

• axios@1.14.1 (Current branch)
• axios@0.30.4 (Legacy branch)

The malware hides in a new dependency called plain-crypto-js@4.2.1. This executes a postinstall-Script that immediately attempts to steal secrets (keys, .env, SSH).

Official Sources and Analyses

• Snyk Security Blog:
  Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT
• Huntress Labs
  (Technische Tiefenanalyse): Supply-Chain Compromise of axios npm Package
• Malwarebytes Labs:
  Axios supply chain attack chops away at npm trust

Interesting Videos for this Supply Chain Attack on Youtube:

NetworkChuck

From NetworkChuck - A Git hosted Guide for Checks!

Axios npm Supply Chain Attack — Detection & Protection Guide

https://github.com/theNetworkChuck/axios-attack-guide

The Legend John Hammond

2hr Live Session

Stay Safe Guys!