Skip to content
OriginalSign in

StepSecurity

axios Compromised on npm - Malicious Versions Drop Remote Access Trojan

Part of the axios story · since 31 Mar

Quiet for 28 weekslast report 13 Apr26 articles13 outlets
31 Mar · StepSecurity first15 Jul20 Aug25 SepNowThis article1st of 26
  • Tue 31 Mar, 01:56 UTC. StepSecurity, first report. axios Compromised on npm - Malicious Versions Drop Remote Access Trojan. This article, 1st of 26.
  • Tue 31 Mar, 07:04 UTC. The Hacker News, its first report on the story. Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account.
  • Tue 31 Mar, 10:13 UTC. SOCRadar, its first report on the story. Axios npm Hijack 2026: Everything You Need to Know – IOCs, Impact & Remediation.
  • Tue 31 Mar, 15:05 UTC. Malwarebytes, its first report on the story. Axios supply chain attack chops away at npm trust.
  • Tue 31 Mar, 16:15 UTC. elastic.co, its first report on the story. Elastic releases detections for the Axios supply chain compromise.
  • Tue 31 Mar, 18:53 UTC. Security Affairs, its first report on the story. Attackers hijack Axios npm account to spread RAT malware.
  • Tue 31 Mar, 18:53 UTC. elastic.co. Inside the Axios supply chain compromise - one RAT to rule them all.
  • Tue 31 Mar, 18:54 UTC. DataBreaches, its first report on the story. Attack on axios software developer tool threatens widespread compromises.
  • Tue 31 Mar, 21:34 UTC. Dark Reading, its first report on the story. Axios NPM Package Compromised in Precision Attack.
  • Wed 1 Apr, 08:27 UTC. The Hacker News. Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069.
  • Wed 1 Apr, 09:00 UTC. SecurityWeek, its first report on the story. Axios NPM Package Breached in North Korean Supply Chain Attack.
  • Wed 1 Apr, 09:31 UTC. Infosecurity, its first report on the story. Hackers Hijack Axios npm Package to Spread RATs.
  • Wed 1 Apr, 14:20 UTC. SANS ISC, its first report on the story. TeamPCP Supply Chain Campaign: Update 005 - First Confirmed Victim Disclosure, Post-Compromise Cloud Enumeration Documented, and Axios Attribution Narrows, (Wed, Apr 1st).
  • Wed 1 Apr, 14:52 UTC. Security Affairs. Google Attributes Axios npm Attack to North Korean UNC1069 Hackers.
  • Wed 1 Apr, 19:08 UTC. Unit 42, its first report on the story. Threat Brief: Widespread Impact of the Axios Supply Chain Attack.
  • Wed 1 Apr, 22:15 UTC. Microsoft, its first report on the story. Mitigating the Axios npm supply chain compromise.
  • Thu 2 Apr, 00:50 UTC. elastic.co. How we caught the Axios supply chain attack.
  • Fri 3 Apr, 12:31 UTC. The Hacker News. North Korean hackers trick npm maintainer to hijack Axios package.
  • Fri 3 Apr, 13:32 UTC. Dark Reading. Source Code Leaks Highlight Lack of Supply Chain Oversight.
  • Sun 5 Apr, 14:50 UTC. Security Affairs. Security Affairs Round 91 spotlights macOS infostealer, npm attack.
  • Mon 6 Apr, 11:32 UTC. SecurityWeek. North Korean hackers target Node.js maintainers after Axios hack.
  • Mon 6 Apr, 14:52 UTC. The Hacker News. North Korea hackers hijack Axios npm package, push WAVESHAPER.V2.
  • Mon 6 Apr, 16:01 UTC. StepSecurity. StepSecurity spots massive axios npm attack before public reveal.
  • Mon 6 Apr, 21:51 UTC. Dark Reading. North Korean hackers compromise Axios NPM via social engineering.
  • Mon 13 Apr, 08:18 UTC. The Hacker News. OpenAI Revokes macOS Signing Key After Axios Supply Chain Hack.
  • Mon 13 Apr, 12:57 UTC. SecurityWeek. OpenAI Hit by Axios Supply Chain Attack Tied to North Korea.

According to StepSecurity, on 31 March 2026 two malicious versions of the axios HTTP client library were published to npm: axios@1.14.1 and axios@0.30.4, both deployed using the compromised credentials of a lead maintainer and bypassing the project’s normal CI/CD pipeline.

The attacker changed the maintainer’s account email to a ProtonMail address and manually published the poisoned packages via the npm CLI, with the malicious versions injecting a new dependency, plain-crypto-js@4.2.1, that is never imported in the axios source.

Its sole purpose is to run a postinstall script that acts as a cross-platform remote access trojan dropper, targeting macOS, Windows and Linux, contacting a live command and control server and delivering second-stage payloads before deleting itself and replacing its package.json to evade forensic detection.

If you have installed axios@1.14.1 or axios@0.30.4, you should assume your system is compromised and pin to safe versions: axios@1.14.0 or axios@0.30.3, while rotating secrets and checking network logs for the indicated indicators of compromise. The post also lists a number of indicators, including the C2 domain sfrclak[.]com and C2 IP 142.11.206[.]73, and notes affected npm accounts jasonsaayman and nrwise.

How the story developed

All 26 articles
Quiet for 28 weekslast report 13 Apr26 articles13 outlets

26 articles from 13 outlets since 31 Mar. Quiet since 13 Apr. This was the first report.

Now31 Mar246810121416First reportStepSecurity · 31 Mar, 01:56Picked up againafter 2 days quietPicked up againafter 6 days quiet
  • Tue 31 Mar, 01:56 UTC. StepSecurity, first report. axios Compromised on npm - Malicious Versions Drop Remote Access Trojan. This article, 1st of 26.
  • Tue 31 Mar, 07:04 UTC. The Hacker News, its first report on the story. Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account.
  • Tue 31 Mar, 10:13 UTC. SOCRadar, its first report on the story. Axios npm Hijack 2026: Everything You Need to Know – IOCs, Impact & Remediation.
  • Tue 31 Mar, 15:05 UTC. Malwarebytes, its first report on the story. Axios supply chain attack chops away at npm trust.
  • Tue 31 Mar, 16:15 UTC. elastic.co, its first report on the story. Elastic releases detections for the Axios supply chain compromise.
  • Tue 31 Mar, 18:53 UTC. Security Affairs, its first report on the story. Attackers hijack Axios npm account to spread RAT malware.
  • Tue 31 Mar, 18:53 UTC. elastic.co. Inside the Axios supply chain compromise - one RAT to rule them all.
  • Tue 31 Mar, 18:54 UTC. DataBreaches, its first report on the story. Attack on axios software developer tool threatens widespread compromises.
  • Tue 31 Mar, 21:34 UTC. Dark Reading, its first report on the story. Axios NPM Package Compromised in Precision Attack.
  • Wed 1 Apr, 08:27 UTC. The Hacker News. Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069.
  • Wed 1 Apr, 09:00 UTC. SecurityWeek, its first report on the story. Axios NPM Package Breached in North Korean Supply Chain Attack.
  • Wed 1 Apr, 09:31 UTC. Infosecurity, its first report on the story. Hackers Hijack Axios npm Package to Spread RATs.
  • Wed 1 Apr, 14:20 UTC. SANS ISC, its first report on the story. TeamPCP Supply Chain Campaign: Update 005 - First Confirmed Victim Disclosure, Post-Compromise Cloud Enumeration Documented, and Axios Attribution Narrows, (Wed, Apr 1st).
  • Wed 1 Apr, 14:52 UTC. Security Affairs. Google Attributes Axios npm Attack to North Korean UNC1069 Hackers.
  • Wed 1 Apr, 19:08 UTC. Unit 42, its first report on the story. Threat Brief: Widespread Impact of the Axios Supply Chain Attack.
  • Wed 1 Apr, 22:15 UTC. Microsoft, its first report on the story. Mitigating the Axios npm supply chain compromise.
  • Thu 2 Apr, 00:50 UTC. elastic.co. How we caught the Axios supply chain attack.
  • Fri 3 Apr, 12:31 UTC. The Hacker News. North Korean hackers trick npm maintainer to hijack Axios package.
  • Fri 3 Apr, 13:32 UTC. Dark Reading. Source Code Leaks Highlight Lack of Supply Chain Oversight.
  • Sun 5 Apr, 14:50 UTC. Security Affairs. Security Affairs Round 91 spotlights macOS infostealer, npm attack.
  • Mon 6 Apr, 11:32 UTC. SecurityWeek. North Korean hackers target Node.js maintainers after Axios hack.
  • Mon 6 Apr, 14:52 UTC. The Hacker News. North Korea hackers hijack Axios npm package, push WAVESHAPER.V2.
  • Mon 6 Apr, 16:01 UTC. StepSecurity. StepSecurity spots massive axios npm attack before public reveal.
  • Mon 6 Apr, 21:51 UTC. Dark Reading. North Korean hackers compromise Axios NPM via social engineering.
  • Mon 13 Apr, 08:18 UTC. The Hacker News. OpenAI Revokes macOS Signing Key After Axios Supply Chain Hack.
  • Mon 13 Apr, 12:57 UTC. SecurityWeek. OpenAI Hit by Axios Supply Chain Attack Tied to North Korea.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 26 articles as a list
  1. Tue 31 MarDay 09
    1. axios Compromised on npm - Malicious Versions Drop Remote Access Trojan01:56 · StepSecurity · First report · This article, 1st of 26
    2. Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account07:04 · The Hacker News
    3. Axios npm Hijack 2026: Everything You Need to Know – IOCs, Impact & Remediation10:13 · SOCRadar
    Show 6 more from 31 Mar
    1. Axios supply chain attack chops away at npm trust15:05 · Malwarebytes
    2. Elastic releases detections for the Axios supply chain compromise16:15 · elastic.co
    3. Attackers hijack Axios npm account to spread RAT malware18:53 · Security Affairs
    4. Inside the Axios supply chain compromise - one RAT to rule them all18:53 · elastic.co
    5. Attack on axios software developer tool threatens widespread compromises18:54 · DataBreaches
    6. Axios NPM Package Compromised in Precision Attack21:34 · Dark Reading
  2. Wed 1 AprDay 17
    1. Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC106908:27 · The Hacker News
    2. Axios NPM Package Breached in North Korean Supply Chain Attack09:00 · SecurityWeek
    3. Hackers Hijack Axios npm Package to Spread RATs09:31 · Infosecurity
    Show 4 more from 1 Apr
    1. TeamPCP Supply Chain Campaign: Update 005 - First Confirmed Victim Disclosure, Post-Compromise Cloud Enumeration Documented, and Axios Attribution Narrows, (Wed, Apr 1st)14:20 · SANS ISC
    2. Google Attributes Axios npm Attack to North Korean UNC1069 Hackers14:52 · Security Affairs
    3. Threat Brief: Widespread Impact of the Axios Supply Chain Attack19:08 · Unit 42
    4. Mitigating the Axios npm supply chain compromise22:15 · Microsoft
  3. Thu 2 AprDay 21
    1. How we caught the Axios supply chain attack00:50 · elastic.co
  4. Fri 3 AprDay 32
    1. North Korean hackers trick npm maintainer to hijack Axios package12:31 · The Hacker News
    2. Source Code Leaks Highlight Lack of Supply Chain Oversight13:32 · Dark Reading

  5. Quiet for 2 days

    Sun 5 AprDay 51
    1. Security Affairs Round 91 spotlights macOS infostealer, npm attack14:50 · Security Affairs · Picked up again
  6. Mon 6 AprDay 64
    1. North Korean hackers target Node.js maintainers after Axios hack11:32 · SecurityWeek
    2. North Korea hackers hijack Axios npm package, push WAVESHAPER.V214:52 · The Hacker News
    3. StepSecurity spots massive axios npm attack before public reveal16:01 · StepSecurity
    4. North Korean hackers compromise Axios NPM via social engineering21:51 · Dark Reading

  7. Quiet for 6 days

    Mon 13 AprDay 132
    1. OpenAI Revokes macOS Signing Key After Axios Supply Chain Hack08:18 · The Hacker News · Picked up again
    2. OpenAI Hit by Axios Supply Chain Attack Tied to North Korea12:57 · SecurityWeek

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in