Hijacked maintainer account let attackers slip cross-platform trojan into 100M-downloads-a-week Axios
UPDATED One of npm's most widely used HTTP client libraries briefly became a malware delivery vehicle after attackers hijacked a maintainer's account and slipped a remote-access trojan (RAT) into two seemingly legitimate axios releases, in what's being described as "one of the most impactful npm supply chain attacks on record."
The poisoned versions, "axios@1.14.1" and "axios@0.30.4," made it onto the npm registry before being yanked, though not before some unlucky devs and CI pipelines pulled them in. Rather than tampering with axios's own code, the intruders took a subtler route, slipping in a dependency that had no business being there and no role in the library's functionality.
Axios is a widely used JavaScript HTTP client that developers rely on to send requests between applications and web services. It's embedded in everything from front-end apps to back-end systems and racks up around 100 million downloads each week, meaning even a short-lived compromise can spread quickly.
The releases didn't come through the project's usual build process either. Security firm StepSecurity found that both versions were published via the compromised npm account of "jasonsaayman," the project's primary maintainer, who was reportedly locked out of the account while the packages were being pushed.
The attackers swapped the account's email address for an anonymous ProtonMail inbox and pushed the infected packages manually via the npm CLI, completely bypassing the project's GitHub Actions CI/CD pipeline and the safeguards developers tend to assume are in place.
The added package, "plain-crypto-js@4.2.1," existed purely as a delivery mechanism. Its post-install script phones home, fetches a second-stage payload, and sets about dropping malware tailored to whatever it finds. On macOS it disguises itself as a system daemon, on Windows it leans on PowerShell, and on Linux it falls back to a Python backdoor. It also tries to cover its tracks, clearing out traces that might give the game away.
StepSecurity said the campaign showed a level of planning well beyond the usual smash-and-grab npm compromise. "This was not opportunistic," said Ashish Kurmi, the firm's CTO and co-founder. "The malicious dependency was staged 18 hours in advance. Three separate payloads were pre-built for three operating systems. Both release branches were hit within 39 minutes. Every trace was designed to self-destruct. This is among the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package."
The incident also comes during a rough stretch for npm. Campaigns such as "Shai-Hulud" and its follow-up, "Shai-Hulud 2.0," show attackers increasingly targeting the software supply chain itself, seeding malicious packages to siphon credentials, hijack environments, or quietly maintain persistence within developer tooling.
Developers who installed either affected version are being urged to act immediately. "If you have installed axios@1.14.1 or axios@0.30.4, assume your system is compromised," Kurmi said.
In practice, that means ripping out dependencies, rotating credentials, and, for some, rebuilding machines from scratch. Given how widely axios is used, the cleanup won't be quick.
Google’s Threat Intelligence Group (GTIG) on Tuesday linked the axios NPM supply chain attack to a suspected North Korean threat actor it tracks as UNC1069 - and not to TeamPCP, the group behind the recent Trivy vulnerability scanner breach and subsequent compromises targeting other popular open source projects.
The axios supply-chain attack is “unrelated to the recent TeamPCP supply chain issues,” GTIG chief analyst John Hultquist told The Register. “We have attributed the attack to a suspected North Korean threat actor we track as UNC1069. North Korean hackers have deep experience with supply chain attacks, which they’ve historically used to steal cryptocurrency. The full breadth of this incident is still unclear, but given the popularity of the compromised package, we expect it will have far reaching impacts.” ®
Updated on March 31 to include Google's statement that UNC1069 is the suspected group behind the attack.