Hackers slipped a trojan into axios, the code library behind most of the internet. Your team is probably affected

Attackers stole a long-lived npm access token and took over the lead axios maintainer’s npm account (@jasonsaayman).

They published two poisoned axios releases via the npm CLI, adding plain-crypto-js@4.2.1; both release branches appeared within 39 minutes and were live on the npm registry for about three hours.

A postinstall script installed a cross-platform remote-access trojan with prebuilt payloads for macOS, Windows, and Linux; the package existed solely to run that postinstall.

The malware erases itself after execution and swaps in a clean package.json to hinder forensic analysis; at least 135 Huntress-customer systems were compromised during the exposure window.

Axios is widely deployed — more than 100 million downloads per week and present in roughly 80% of cloud and code environments — and this is the third major npm supply-chain compromise in seven months, with every incident exploiting maintainer credentials.