axios npm package hijacked and poisoned with remote access trojan in versions 1.14.1 and 0.30.4 via compromised maintainer account.
Security & Exploits ·
On March 31, 2026, StepSecurity identified two malicious versions of the axios HTTP client library published to npm: versions 1.14.1 and 0.30.4. Both were released using compromised npm credentials belonging to a lead axios maintainer, with the attacker changing the account email to an anonymous ProtonMail address and publishing directly via the npm CLI, circumventing the project's GitHub Actions pipeline.
The poisoned packages inject a hidden dependency, plain-crypto-js@4.2.1, that never appears in axios source code. A postinstall script within this fake dependency acts as a cross-platform remote access trojan dropper, targeting macOS, Windows, and Linux systems. The malware contacts a command-and-control server to deliver platform-specific payloads, then self-destructs and replaces its own package.json with a clean version to evade detection.
The attack showed significant operational sophistication: the malicious dependency was staged 18 hours before the axios releases, three separate payloads were pre-built by operating system, and both branches were published within 39 minutes. StepSecurity recommends that anyone who installed the affected versions assume compromise, downgrade to safe releases (1.14.0 or 0.30.3), and rotate all secrets and credentials on affected machines.