Axios Supply Chain Attack: 100M Weekly Downloads Turned Into a RAT Delivery System

News

Axios NPM Distribution Compromised in Supply Chain Attack

A hijacked maintainer account pushed two malicious axios versions (1.14.1 and 0.30.4) that deployed a full cross-platform RAT to any machine that ran npm install during a 2-3 hour window. With axios in ~80% of cloud environments and 100M weekly downloads, even a short exposure window resulted in measurable execution across real production systems.

Analysis

Axios Supply Chain Attack: Full Timeline, RAT Analysis, and IOCs

This is the most detailed technical breakdown of the attack chain, including how the attacker staged a clean decoy package the day before and bypassed axios's CI/CD Trusted Publisher controls by publishing manually via stolen npm credentials. Socket flagged the malicious dependency within six minutes, but the damage window was still wide enough to matter.

How the Axios RAT Actually Works: Stage-by-Stage Breakdown

Unlike most supply chain attacks that just grab env vars, this one installed persistent backdoors tailored per OS -- a Mach-O binary on macOS disguised as an Apple daemon, a hidden PowerShell script on Windows, and a Python script on Linux -- all beaconing to a C2 every 60 seconds. If you ran npm install during the window, rotate every credential on that machine immediately.

SANS Institute: Axios NPM Supply Chain Compromise Deep Dive

SANS puts this in context as a textbook example of the maintainer account takeover threat vector that keeps getting discussed at conferences but rarely gets this much real-world exposure. Worth reading for the concise summary of who exactly is affected -- developer workstations, CI/CD pipelines, and production systems rebuilt during the 00:21 to 03:15 UTC window on March 31.

Tools

Axios npm Supply Chain Attack: Incident Response Checklist

Practical response guide covering what to check, in what order, and within what timeframe. Key callout: the RAT self-destructs after execution, so inspecting node_modules after the fact tells you nothing -- you need to look for OS-level artifacts and beacon traffic to sfrclak[.]com:8000.