The npm account of an Axios maintainer was the target of a cyberattack on March 31, 2026, resulting in the publication of two malicious versions of the popular npm package (v1.14.1 and v0.30.4). Este incident introduced a dependency for `plain-crypto-js`, a new trojanized package, generating a significant vulnerability in the software supply chain.
Although the compromised versions were promptly removed within hours, the widespread use of Axios – present in approximately 80% of cloud and code environments, and with approximately 100 million weekly downloads – facilitated rapid exposure. Observou malware was executed in 3% of affected environments before the threat was completely contained.
Organizations around the world are now strongly advised to conduct rigorous audits of their systems to identify any possible execution of these compromised versions, tracked by the IDs GHSA-fw8c-xr5c-95f9 and MAL-2026-2306, and take immediate corrective action to mitigate risks.
Breach Details and Malicious Packages
The fraudulent versions of Axios were differentiated from the legitimate ones by including a direct dependency on `plain-crypto-js`, a package that was specifically created with malicious intent. Essas Compromised edits were introduced directly into the npm registry via a breached maintainer account, and were later removed after the flaw was quickly discovered.
Even with a relatively short window of exposure, the high prevalence of Axios in the development community has resulted in considerable spread, culminating in measurable executions of the malicious code in diverse environments. Essa situation underscores the speed at which supply chain attacks can propagate, even with rapid containment responses.
Infection mechanisms and types of malware
The malicious package contains a dropper, identified as `setup.js`, which has the function of downloading and executing platform-specific second-phase payloads from the server `sfrclak.com:8000`. Após execution, the dropper performs self-cleaning, removing and restoring a clean `package.json` file, aiming to make detection more difficult. The secondary payloads operate as lightweight remote access trojans (RATs), communicating with the command and control server (C2) every 60 seconds, transmitting system inventory and awaiting instructions. Embora Although the three variants implement similar functionality—including remote shell execution, binary injection, directory browsing, process listing, and system awareness—they differ in their implementation for each operating system. On macOS, the payload is a universal binary Mach-O compiled in C++, capable of signing payloads injected through codesign. No Windows, the payload is a PowerShell script that establishes persistence via an Run (MicrosoftUpdate) registry key and a re-download batch file. Já on Linux, the payload is delivered as an Python script, demonstrating attackers’ versatility in targeting different platforms.
More on this story: Hackers claim attack and Uber Freight investigates data breach
Urgent actions for security teams
Given the severity of the incident, security teams must prioritize a series of immediate actions. It is crucial to audit the use of Axios to identify whether the affected versions (1.14.1 or 0.30.4) have been downloaded or run anywhere in the development or production environment.
If there is any indication of execution of malicious packages, the premise must be that credentials have been compromised. Recomenda Scan affected systems for secrets, such as environment variables, API keys, and access tokens, and rotate these credentials.
Additionally, it is imperative to investigate possible paths of compromise. Teams should review build pipelines and developer machines for any signs of unauthorized access or persistence, as malware may have propagated during installation and compromised the upstream supply chain.
Ongoing vigilance is essential, with monitoring for suspicious activity, including outbound connections to `sfrclak.com:8000`. Também It is essential to analyze logs for beaconing behaviors, anomalous HTTP POST requests, or unexpected process executions related to package installation.
On the same topic: WhatsApp implements new maximum protection mode to shield accounts against spyware and phishing
Key Identifiers of Compromise (IOCs)
Accurate identification of malicious artifacts is critical for incident mitigation and response. Diversos indicators of compromise have been cataloged to assist organizations in detecting exposures and infections.
Among the first-phase compromised packages, `axios-0.30.4.tgz` (SHA256: 59336a964f110c25c112bcc5adca7090296b54ab33fa95c0744b94f8a0d80c0f) and `axios-1.14.1.tgz` stand out. (SHA256: 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd), both representing the initial stage of the attack via npm packages.
The stage 1.5 malicious package, the Trojanized `plain-crypto-js-4.2.1.tgz`, has the SHA256 hash: 58401c195fe0a6204b42f5f90995ece5fab74ce7c69c67a24c61a057325af668. Este component is critical, as it was the dependency that introduced the nefarious code into the systems.
Second-phase payloads were also identified: for macOS, the binary for and for Linux, the Python script `ld.py` (SHA256: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf).
Other important IOCs include:
Learn more: KFC in Japan faces service suspension and risk of closure after cyber attack
Response and prevention of attacks in the supply chain
Rapid detection and removal of malicious versions of Axios, while crucial, does not eliminate the need for deeper analysis of the resiliency of software supply chains. Incidentes like this reinforce the importance of proactive security strategies, which go beyond the mere reaction to already completed attacks. Desenvolvedores and organizations must implement robust measures to secure their workflows, from initial coding to final delivery, ensuring the integrity of each component.
Supply chain security depends on a multifaceted approach, including adopting strong multi-factor authentication (MFA) for all developer and package maintainer accounts, rigorous code reviews, and the use of automated dependency scanning tools. Essas practices help identify and mitigate vulnerabilities before they can be exploited by malicious actors, creating a more effective barrier against future compromise attempts.
Evolution of security in package managers
The threat landscape for package managers like NPM is constantly evolving, requiring platforms and the developer community to continually adapt. Awareness of supply chain security has increased dramatically in recent years, leading to improvements in policies and detection tools.
Collaborative efforts between maintainers, security companies, and the NPM platform itself are essential to strengthening defenses. Isso includes implementing more stringent security checks for new packages and updates, as well as spreading best practices among users and contributors in the open source community.
Ongoing Measures for Developers
To ensure ongoing security, developers must maintain vigilant behavior. Isso includes checking the authenticity and reputation of new packages before integrating them into projects and preferring well-established and actively maintained dependencies.