Axios NPM Distribution Compromised in Supply Chain Attack

A compromised axios maintainer account led to malicious npm releases that propagated across environments. Learn how to assess impact, detect compromise, and secure your development workflows.

On March 31, 2026 (at 00:21 UTC for v1.14.1 and 01:00 UTC for v0.30.4), an unknown threat actor compromised the npm account of anaxiosmaintainer and published two malicious versions of thenpm package(v1.14.1,v0.30.4), which introduced a dependency onplain-crypto-js, a newly created malicious package. Although the malicious versions were removed within a few hours, axios’s widespread usage -present in ~80% of cloud and code environments and downloaded ~100 million times per week- enabled rapid exposure, withobserved execution in 3% of affected environments. Organizations are strongly advised to audit their environments for potential execution of these versions (tracked asGHSA-fw8c-xr5c-95f9andMAL-2026-2306).

The malicious versions ofaxiosdiffered from legitimate releases by including a dependency onplain-crypto-js, a trojanized package. These versions were published directly via a compromised maintainer account and later removed from npm following disclosure. Due to the short exposure window but high prevalence of axios, even limited availability resulted in measurable execution across environments.

The malicious package includes a dropper (setup.js) that downloads and executes platform-specific second-stage payloads fromsfrclak.com:8000, and then self-cleans by deleting itself and restoring a clean package.json. The second-stage payloads function as lightweight remote access trojans (RATs) and beacon to the C2 server every 60 seconds, transmitting system inventory and awaiting commands.

All three variants implement similar capabilities, including remote shell execution, binary injection, directory browsing, process listing, and system reconnaissance, while differing by operating system. On macOS, the payload is a C++ compiled Mach-O universal binary, and is capable of self-signing injected payloads via codesign. On Windows, the payload is a PowerShell script that establishes persistence via a registry Run key (MicrosoftUpdate) and a re-download batch file. On Linux, the payload is delivered as a Python script.

Audit axios usage:Identify whether the affected versions (1.14.1,0.30.4) were downloaded or executed in your environment. Immediately remove any malicious artifacts from endpoints, build systems, and production workloads.

Rotate exposed credentials:If there is any indication that the malicious packages were executed, assume credential compromise. Scan affected systems for secrets (e.g., environment variables, API keys, tokens) and rotate them accordingly.

Investigate potential compromise paths:Review build pipelines and developer machines for signs of unauthorized access or persistence, as the malware executes during installation and may enable upstream supply chain compromise.

Monitor for suspicious activity:Detect and investigate outbound connections to sfrclak.com:8000, and analyze logs for beaconing behavior, anomalous HTTP POST requests, or unexpected process execution related to package installation.

Wiz customers can refer to the advisory in theWiz Threat Centerfor ongoing guidance, pre-built queries, and references to relevant detections they can use to assess the risk in their environment and detect the presence of the malicious package or past executions.

Worried you’ve been impacted?Connect with the Wiz Incident Response team.

GitHub discussion

Step Security blogpost

Elastic Security gist

Invictus blogpost

How TeamPCP are leveraging stolen secrets from the recent supply chain attacks to compromise cloud environments

Accelerate your SecOps team with the Blue Agent for threat investigation, now Generally Available

Verified by Microsoft. Built for Azure. Secured by Wiz.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings