How the axios@1.14.1 supply chain attack worked (and how to protect yourself)

March 31, 2026: the npm account of Axios's lead maintainer was hijacked and two malicious releases were published — axios@1.14.1 and axios@0.30.4.

Both releases added a hidden dependency called plain-crypto-js; its postinstall script installed a cross-platform RAT on any machine that ran npm install.

The RAT downloaded a platform-specific binary, established a C2 connection, harvested SSH keys, cloud tokens, AWS credentials and other data, and modified package.json.

The malicious packages were live on npm for over 12 hours; Axios averages 40+ million weekly downloads. The attacker pre-staged plain-crypto-js@4.2.1, changed the account email to an attacker-controlled ProtonMail address (npm did not require re-authentication), and published the two axios releases within 39 minutes.

Detection was delayed across tools (npm audit, Dependabot, Snyk, Socket.dev). Pinning dependencies and using lockfiles help but do not protect when a developer runs npm install axios@latest.