Was Axios Poisoned? The Complete Guide to the 2026 NPM Supply Chain Attack

The Unprecedented Compromise of the Axios Library

On March 31, 2026, the global developer community was rocked by an alarming discovery: Axios, one of the most popular HTTP client libraries for JavaScript and Node.js with tens of millions of weekly downloads, was the victim of a severe supply chain attack. Security researchers at StepSecurity identified that malicious actors had successfully infiltrated the npm registry, publishing poisoned versions of the library designed to drop Remote Access Trojans (RATs) onto developers' machines.

This incident highlights a growing trend in cybersecurity where attackers target the foundational building blocks of modern software. For developers managing sensitive codebases or multiple digital identities, relying on isolated environments is no longer optional. Tools like AntidetectBrowser are highly recommended as a first line of defense. By utilizing secure, isolated browser profiles and environments, developers can prevent the catastrophic cross-contamination of credentials that often follows a local machine compromise.

How the Attack Unfolded: Bypassing the CI/CD Pipeline

The attackers executed a highly sophisticated and stealthy operation. Rather than attempting to find a vulnerability in the Axios codebase itself, they targeted the human element—specifically, the npm credentials of a core Axios maintainer.

• Account Hijacking: The attackers gained access to the npm account of a lead maintainer. They immediately altered the account's associated email address to an anonymous ProtonMail account to lock out the legitimate owner and intercept any security alerts.
• Bypassing GitHub Actions: Modern open-source projects rely heavily on automated CI/CD pipelines (like GitHub Actions) to build and publish packages securely. The attackers bypassed this entirely, utilizing the npm Command Line Interface (CLI) to manually push the poisoned packages directly to the registry.
• The Decoy Strategy: To avoid triggering automated security scanners, the attackers published a clean version of a fake dependency 18 hours prior to the attack. This created a false sense of legitimacy before the actual malicious payload was deployed.

Analyzing the Malicious Payload: The plain-crypto-js Trojan

The compromised versions of Axios—specifically [email protected] and [email protected]—did not contain modified core logic. Instead, the attackers injected a fraudulent dependency named [email protected] into the package.json file.

This package was designed to mimic the popular crypto-js library. However, it contained a highly obfuscated setup.js script mapped to the npm postinstall hook. This meant that the moment a developer ran npm install axios, the malicious script executed automatically in the background with the privileges of the user.

Cross-Platform Execution and Persistence

Once triggered, the script decoded a Base64 string to contact a remote Command and Control (C2) server (sfrclak[.]com). It then downloaded and executed OS-specific malware:

• Windows: The malware located the PowerShell binary and copied it to %PROGRAMDATA%\wt.exe, masquerading as the legitimate Windows Terminal. It then used VBScript to open a completely hidden command window, executing a PowerShell script (6202033.ps1) to establish a persistent backdoor.
• macOS: The payload was downloaded to /Library/Caches/com.apple.act.mond. It disguised itself as a core system file, running silently in the background to harvest data and await remote commands.
• Linux: Utilizing Node.js's execSync function, the script downloaded a Python payload to /tmp/ld.py and executed it using nohup, ensuring the process continued running even after the terminal session was closed.

In a final act of evasion, the malware deleted the setup.js script and replaced the modified package.json with a clean version. If a developer inspected their node_modules folder after installation, everything would appear perfectly normal.

How to Detect and Remediate the Axios Infection

If you suspect your development environment or CI/CD pipeline may have downloaded the compromised versions, immediate action is required. Below are the steps to detect the presence of the malware.

1. Check Your Installed Axios Version

Run the following commands in your terminal to check for the malicious versions:

npm list axios 2>/dev/null | grep -E "1\.14\.1|0\.30\.4"
npm list -g axios 2>/dev/null | grep -E "1\.14\.1|0\.30\.4"

You can also check for the presence of the malicious dependency directly:

ls node_modules/plain-crypto-js

2. Check for OS-Specific Indicators of Compromise (IoCs)

Execute the following commands based on your operating system to see if the payload was successfully dropped:

# For macOS
ls -la /Library/Caches/com.apple.act.mond

# For Linux
ls -la /tmp/ld.py

# For Windows (Command Prompt)
dir "%PROGRAMDATA%\wt.exe"

3. Remediation Steps

If any of the above checks return positive results, your system is considered compromised. You must assume that all local credentials have been exfiltrated.

1. Isolate the Machine: Disconnect the infected machine from the network immediately.
2. Rotate All Secrets: Revoke and regenerate all npm tokens, SSH keys, AWS/GCP/Azure cloud credentials, and database passwords that were present on the machine.
3. Wipe and Reinstall: Because the malware establishes deep persistence, simply deleting the node_modules folder is insufficient. A complete operating system wipe and reinstall is highly recommended.
4. Downgrade/Upgrade Axios: Ensure your package.json strictly defines safe versions of Axios (e.g., <= 1.14.0, <= 0.30.3, or versions released after the incident).

Version Safety Comparison Table

Best Practices to Prevent Supply Chain Attacks

The Axios incident is a stark reminder that even the most trusted packages can become attack vectors. To protect your development lifecycle, consider adopting the following practices:

• Disable Automatic Postinstall Scripts: You can prevent postinstall scripts from running automatically by using the --ignore-scripts flag when installing packages (e.g., npm install --ignore-scripts).
• Use Lockfiles: Always commit package-lock.json or yarn.lock to ensure that builds are reproducible and that unexpected nested dependencies aren't silently introduced.
• Implement Environment Sandboxing: Never test new dependencies on your primary machine containing production keys. Utilize virtual machines, Docker containers, or advanced isolation tools like AntidetectBrowser to keep your development, testing, and browsing environments strictly segregated.
• Enforce 2FA: If you are a package maintainer, enforcing Two-Factor Authentication (2FA) on your npm and GitHub accounts is non-negotiable.

"Supply chain security is no longer just about scanning your own code; it is about verifying the integrity of the entire ecosystem you rely upon." — Cybersecurity Expert

For more information on securing your Node.js applications, refer to the official npm audit documentation.

Understanding the Threat Landscape

To better understand how these attacks infiltrate the npm ecosystem, watch this educational breakdown of supply chain vulnerabilities: