Axios npm Attack Pushes RAT Through Malicious Packages

Published on: March 31, 2026

A major supply chain attack has hit the popular JavaScript library Axios, exposing developers to a stealthy cross platform remote access trojan.

Quick Summary – TLDR:

Malicious versions axios 1.14.1 and 0.30.4 were published using a compromised maintainer account.
Attackers injected a fake dependency plain crypto js to deploy a hidden RAT.
The malware targeted macOS, Windows, and Linux with platform specific payloads.
Developers are urged to downgrade immediately and rotate credentials.

What Happened?

Two malicious versions of the widely used npm package Axios were published after attackers gained access to a maintainer account. Instead of modifying Axios directly, they introduced a hidden dependency that silently executed a remote access trojan during installation. The attack bypassed standard security checks and spread quickly due to Axios’ massive usage across projects.

🚨 CRITICAL: Active supply chain attack on axios — one of npm’s most depended-on packages.

The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios…
— Feross (@feross) March 31, 2026

A Carefully Planned Supply Chain Attack

The attack targeted one of the most trusted libraries in the JavaScript ecosystem. Axios sees tens to hundreds of millions of weekly downloads, making it a high impact entry point.

Security researchers found that attackers used compromised npm credentials of the primary maintainer to publish the infected versions. The email linked to the account was changed to an anonymous ProtonMail address, allowing the attacker to maintain control and avoid detection. Crucially, the malicious packages were published outside the normal CI/CD pipeline, which meant automated checks were bypassed entirely.

What makes this attack stand out is its level of preparation. Researchers noted that:

A clean version of the malicious package was published first to build trust.
The weaponized version appeared around 18 hours later.
Both infected Axios releases were pushed within 39 minutes of each other.
The malware contacted its command server within seconds of installation.

This was not random activity. It was a deliberate and coordinated operation.

How the Malware Works?

Interestingly, Axios itself remained untouched. There was no malicious code inside the library, making traditional code reviews ineffective.

Instead, attackers injected a dependency called plain crypto js version 4.2.1, which is not used anywhere in the Axios codebase. Its only purpose was to execute a post install script.

This script acted as a dropper for a remote access trojan, which behaved differently depending on the operating system:

On macOS, it downloaded a binary disguised as a system file and executed it in the background.
On Windows, it copied PowerShell to a fake system path and ran a hidden script using VBScript.
On Linux, it fetched a Python script and executed it silently.

All variants communicated with the same command and control server, sending system data and receiving instructions. The malware supported actions such as:

Executing shell commands
Running additional payloads
Accessing files on the system

Notably, the malware did not establish persistence, suggesting it was designed for quick data theft or follow up attacks.

Built to Evade Detection

One of the most alarming aspects of the attack is how it covered its tracks.

After executing, the malicious package performed several cleanup steps:

Removed the post install script.
Deleted the modified package file.
Replaced it with a clean looking version.

This meant that even if developers inspected their node modules later, they would find no obvious signs of compromise.

Security experts pointed out that the malicious behavior lived entirely in a transitive dependency, making it extremely difficult to detect using standard review methods.

What Developers Should Do Now?

Developers who installed the affected versions should act immediately.

Recommended steps include:

Downgrade to safe versions such as axios 1.14.0 or 0.30.3.
Remove the plain crypto js package from dependencies.
Check for suspicious files like.
- /Library/Caches/com.apple.act.mond on macOS
- %PROGRAMDATA%wt.exe on Windows
- /tmp/ld.py on Linux
Rotate all credentials, including API keys, tokens, and SSH keys.
Audit CI/CD pipelines for exposure.
Consider using install flags to disable scripts during dependency installation.

Security researchers warn that if any indicators are found, systems should be treated as fully compromised.

SQ Magazine’s Takeaway

I think this incident shows how fragile the open source ecosystem really is right now. Even a trusted library like Axios can become a threat overnight without a single line of its own code being changed. That is what makes this attack scary.

What stood out to me is the precision. This was not a noisy attack. It was quiet, fast, and designed to disappear. If developers are not actively monitoring their dependencies and build processes, they could miss something like this completely.

Going forward, I believe teams need to treat dependencies as part of their attack surface, not just tools. Simple steps like restricting install scripts and auditing packages more closely can make a real difference.