Executive Summary
On March 31, 2026, the popular npm package Axios was targeted in a supply chain attack after a maintainer account ('jasonsaayman') was compromised. The attackers published malicious versions (1.14.1 and 0.30.4) that included a new dependency, 'plain-crypto-js', which acted as a downloader for an OS-specific Remote Access Trojan (RAT). These versions were available for approximately three hours and affected over 10,000 users before being removed from the npm registry.
The attack utilizes a highly automated delivery chain where a setup script ('setup.js') identifies the victim's operating system—Windows, macOS, or Linux—and retrieves a customized payload from a central C2 server. The malware facilitates data exfiltration and remote command execution, with the Windows variant specifically implementing persistence via registry modifications. Given the massive adoption of Axios, this incident highlights the significant risk of upstream dependencies in the modern development ecosystem.
Organizations using Axios should immediately verify their dependency versions and lock files. Any installation of the compromised versions should be treated as a full system breach, necessitating the rotation of sensitive credentials and secrets that may have been accessible in the environment.