How the Axios NPM Supply Chain Attack Works and How to Protect API Projects

The Axios npm primary maintainer account was compromised on 2026-03-31; the attacker changed the account email to ifstap@proton.me and published malicious versions 1.14.1 and 0.30.4. The incident began with 1.14.1 published 2026-03-31 00:21 UTC and npm removed the releases within 2–3 hours.

The malicious releases had no OIDC binding, lacked gitHead and GitHub repo links, and were published manually with a stolen token rather than via the normal OIDC Trusted Publisher + GitHub Actions flow.

The attacker injected a dependency plain-crypto-js@^4.2.1 into package.json and hid a postinstall setup.js. setup.js decodes its payload using an XOR layer then string reversal plus Base64.

The decoded payload deployed a RAT per OS (macOS/Windows/Linux). The RAT supports arbitrary command execution, file-system operations and data theft, process enumeration and injection, fileless execution, and beacons to C2 every 60 seconds.

Forensic evasion included deleting setup.js and removing/renaming the malicious package.json; leaked items included dev .env files, API keys, SSH keys, and cloud credentials. Google threat intel attributes the operation to North Korea–linked UNC1069 and identifies a macOS malware name WAVESHAPE.