Axios Supply Chain Attack via Malicious npm Versions

Security researchers have uncovered a sophisticated supply chain attack on the popular JavaScript library axios, with two malicious versions published to the npm registry on March 31, 2026, potentially exposing millions of developers' systems to a cross-platform remote access trojan.

The affected versions, axios 1.14.1 and axios 0.30.4, were released using the compromised npm account of the library's primary maintainer, Jason Saayman. Attackers altered the account's email to an anonymous ProtonMail address and manually uploaded the packages via the npm command-line interface, sidestepping the project's standard GitHub Actions continuous integration and deployment process. Axios, an HTTP client used in Node.js and browser environments, boasts over 300 million weekly downloads, making it a staple in countless web applications, frontend frameworks, and backend services.

The malicious code does not alter axios itself but introduces a bogus dependency, plaincryptojs version 4.2.1, masquerading as the legitimate crypto-js library. This package, which shares the same description, author, and repository details as its genuine counterpart, executes a postinstall script upon installation....