Executive Summary
On March 31, 2026, the widely used JavaScript library 'axios' was compromised through the hijacking of a lead maintainer's npm account. The attacker published malicious versions (1.14.1 and 0.30.4) that included a 'phantom' dependency, 'plain-crypto-js@4.2.1'. This malicious dependency contained a post-install script designed to deploy second-stage payloads across Windows, macOS, and Linux systems.
The attack demonstrated high operational sophistication, including 18 hours of pre-staging decoy packages, surgical modifications to manifest files, and extensive anti-forensic measures to swap malicious files with clean stubs after execution. While the malicious versions were removed within three hours, any environment that performed an 'npm install' during that window is likely compromised. Impacted sectors are broad due to the ubiquitous nature of the axios library in modern web development and CI/CD pipelines.
Key Details
Threat Name
axios npm Supply Chain Attack
Affects
—
Adversary
nrwise
MITRE Techniques
—
Malware/Tools
plain-crypto-js, com.apple.act.mond, ld.py