Axios npm Package Compromised in Supply Chain Attack Affecting 100 Million Weekly Downloads

Q: What Happened

On March 30, attackers published axios@1.14.1 and axios@0.30.4 to npm after compromising the primary maintainer’s account. The malicious versions inject a hidden dependency called plain-crypto-js whose sole purpose is to execute a RAT dropper targeting macOS, Windows, and Linux. The attack was pre-staged across 18 hours — the malicious dependency was seeded on npm before the axios releases to avoid “new package” security alarms. Within two seconds of npm install, the malware was already calling home to the attacker’s server before npm had even finished resolving dependencies.

Q: What You Should Do

If you’re running axios 1.14.1 or 0.30.4, update immediately. Check your package-lock.json for plain-crypto-js as a dependency. Run a full system scan on any machine that installed the compromised versions.

By Jaspal April 1, 2026 Updated: April 1, 2026

The most popular JavaScript HTTP client just got weaponized. Axios, with over 100 million weekly npm downloads and present in roughly 80% of cloud environments, was compromised in a supply chain attack that injected a cross-platform remote access trojan (RAT) into two malicious versions.

What Happened

On March 30, attackers published axios@1.14.1 and axios@0.30.4 to npm after compromising the primary maintainer’s account. The malicious versions inject a hidden dependency called plain-crypto-js whose sole purpose is to execute a RAT dropper targeting macOS, Windows, and Linux.

The attack was pre-staged across 18 hours — the malicious dependency was seeded on npm before the axios releases to avoid “new package” security alarms. Within two seconds of npm install, the malware was already calling home to the attacker’s server before npm had even finished resolving dependencies.

The Sophistication

This is among the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package. The attacker changed the maintainer account’s email to a ProtonMail address (ifstap@proton.me) and published versions that looked like routine updates.

Although the malicious versions were removed within hours, axios’s massive footprint meant rapid exposure — execution was observed in 3% of affected environments.

What You Should Do

If you’re running axios 1.14.1 or 0.30.4, update immediately. Check your package-lock.json for plain-crypto-js as a dependency. Run a full system scan on any machine that installed the compromised versions.

The Bottom Line

When a package with 100 million weekly downloads gets compromised, it’s not just a security incident — it’s an infrastructure attack. The npm ecosystem’s dependency on single-maintainer packages remains its biggest vulnerability. Until package registries solve the maintainer account security problem, every developer is one compromised password away from shipping malware to their users.