Axios NPM Supply Chain Attack: What the RAT Incident Means for JS Security

News

Axios NPM Compromised: Malicious Maintainer Account Takeover Deploys Cross-Platform RAT

On March 31, 2026, attackers hijacked the axios npm maintainer account and published two backdoored versions (v1.14.1 and v0.30.4) that silently installed a RAT via a phantom dependency called plain-crypto-js. With axios present in roughly 80% of cloud environments, even a 3-hour exposure window was enough to confirm execution in 3% of affected environments. If you ran npm install during that window, treat every secret on that machine as compromised. wiz.io

Analysis

Axios Supply Chain Attack: Technical Breakdown and Remediation Steps

Orca's breakdown covers the full attack chain: compromised npm token, postinstall hook, platform-specific second-stage payloads (PowerShell on Windows, Python on Linux, Mach-O binary on macOS), and anti-forensic self-deletion. The key tactical action is pinning to axios@1.14.0 or axios@0.30.3 and checking for the presence of node_modules/plain-crypto-js as a compromise indicator. orca.security

How the Axios Maintainer Account Was Hijacked and Why GitHub Actions Didn't Catch It

The attacker bypassed the project's OIDC-signed GitHub Actions pipeline entirely by using a stolen long-lived npm access token, meaning the GitHub repo showed nothing suspicious. This is the critical lesson: registry-level publish controls and OIDC trusted publishers need to be enforced together, not just one or the other. ironplate.ai

Why Traditional CVE Scanners Will Miss the Axios Supply Chain Compromise

No CVE was assigned because there is no vulnerability in the axios codebase itself, which means most dependency scanning tools will not flag the compromised versions. This exposes a real gap in the standard AppSec toolchain: behavioral and provenance-based detection is the only reliable catch here. phoenix.security

Threat Intelligence

Axios RAT Payload Deep Dive: Obfuscation Layers, C2 Beaconing, and Persistence Mechanisms

The dropper used Base64, string reversal, and double XOR to hide intent before pulling platform-specific payloads from sfrclak.com:8000, with the Windows variant establishing registry persistence as MicrosoftUpdate and the macOS variant masquerading as an Apple daemon. The attacker pre-published a clean decoy package days earlier to establish registry history, showing significant pre-attack planning. threatlandscape.io