Axios npm package compromised, posing a new supply chain threat
Key summary
Two malicious axios releases (axios@1.14.1 and axios@0.30.4) were published to npm on March 31, 2026 via a hijacked maintainer account belonging to jasonsaayman.
The attacker changed that account's email address to an anonymous ProtonMail address.
Both compromised axios packages include a fake dependency plain-crypto-js@4.2.1 that mimics crypto-js; the attacker first published plain-crypto-js@4.2.0 on March 30 to build history, then released 4.2.1 about eighteen hours later and the infected axios versions followed within an hour.
The compromised versions install a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux; on macOS the RAT binary is stored at /Library/Caches/com.apple.act.mond.
The post-install script removes itself, deletes the package.json containing the malicious hook, and replaces it with a clean version; the infected packages were published via the npm CLI, bypassing GitHub Actions CI/CD; axios has over 300 million weekly downloads.
