Overview

On March 31, 2026 (at 00:21 UTC for v1.14.1 and 01:00 UTC for v0.30.4), an unknown threat actor compromised the npm account of an axios maintainer and published two malicious versions of the npm package (v1.14.1, v0.30.4), which introduced a dependency on plain-crypto-js, a newly created malicious package. Although the malicious versions were removed within a few hours, axios’s widespread usage - present in ~80% of cloud and code environments and downloaded ~100 million times per week - enabled rapid exposure, with observed execution in 3% of affected environments. Organizations are strongly advised to audit their environments for potential execution of these versions (tracked as GHSA-fw8c-xr5c-95f9 and MAL-2026-2306).

Technical Details

The malicious versions of axios differed from legitimate releases by including a dependency on plain-crypto-js, a trojanized package. These versions were published directly via a compromised maintainer account and later removed from npm following disclosure. Due to the short exposure window but high prevalence of axios, even limited availability resulted in measurable execution across environments.

The malicious package includes a dropper (setup.js) that downloads and executes platform-specific second-stage payloads from sfrclak.com:8000, and then self-cleans by deleting itself and restoring a clean package.json. The second-stage payloads function as lightweight remote access trojans (RATs) and beacon to the C2 server every 60 seconds, transmitting system inventory and awaiting commands.

All three variants implement similar capabilities, including remote shell execution, binary injection, directory browsing, process listing, and system reconnaissance, while differing by operating system. On macOS, the payload is a C++ compiled Mach-O universal binary, and is capable of self-signing injected payloads via codesign. On Windows, the payload is a PowerShell script that establishes persistence via a registry Run key (MicrosoftUpdate) and a re-download batch file. On Linux, the payload is delivered as a Python script.

Which actions should security teams take?

1. Audit axios usage: Identify whether the affected versions (1.14.1, 0.30.4) were downloaded or executed in your environment. Immediately remove any malicious artifacts from endpoints, build systems, and production workloads.

2. Rotate exposed credentials: If there is any indication that the malicious packages were executed, assume credential compromise. Scan affected systems for secrets (e.g., environment variables, API keys, tokens) and rotate them accordingly.

3. Investigate potential compromise paths: Review build pipelines and developer machines for signs of unauthorized access or persistence, as the malware executes during installation and may enable upstream supply chain compromise.

4. Monitor for suspicious activity: Detect and investigate outbound connections to sfrclak.com:8000, and analyze logs for beaconing behavior, anomalous HTTP POST requests, or unexpected process execution related to package installation.

How can Wiz help?

Wiz customers can refer to the advisory in the Wiz Threat Center for ongoing guidance, pre-built queries, and references to relevant detections they can use to assess the risk in their environment and detect the presence of the malicious package or past executions.

Worried you’ve been impacted? Connect with the Wiz Incident Response team.

References

• GitHub discussion

• Step Security blogpost

• Elastic Security gist

• Invictus blogpost

Appendix - Indicators of compromise (IOCs)