Axios compromised on npm: a remote access trojan shipped through a library with 100 million weekly downloads

2026-03-31 · Publisher : npm · Domain : Cloud & DevOps

On 31 March 2026, two booby-trapped axios versions (1.14.1 and 0.30.4) are published for about three hours after the maintainer's account is hijacked. They install a remote access trojan on macOS, Windows and Linux.

### Background On 31 March 2026, attackers take over the account of axios's lead maintainer, a very widely used JavaScript HTTP client library, and publish two malicious versions: 1.14.1 and 0.30.4. They add a hidden dependency, plain-crypto-js, whose postinstall script installs a remote access trojan. The versions stay online for about three hours, from 00:21 to 03:20 UTC according to Google. ### Key facts - Axios exceeds 100 million weekly downloads for the 1.x branch and 83 million for the 0.30 branch, according to Google. - The postinstall script runs an obfuscated dropper, then installs a backdoor tailored to Windows, macOS or Linux. - Google Threat Intelligence attributes the operation to UNC1069, a North Korea-nexus, financially motivated actor active since 2018. - Recommended measures: search lockfiles for the affected versions and plain-crypto-js, roll back to axios 1.14.0 or 0.30.3, rotate all credentials and pause deployments. - Isolating development environments in containers or sandboxes is also recommended. ### Why it matters The attack targets developer workstations and CI runners, where delivery secrets are most numerous. Teams that run npm install with floating versions or active install scripts were exposed within a window of a few hours. The episode motivates the measures the ecosystem now pushes: strict locking, install scripts disabled by default and a cooling-off delay before adopting a new release. ### Takeaway Three hours of publication are enough: lock versions, disable install scripts and let new releases mature.

Tags : Sécurité, CI/CD, Open Source, DevOps