Loading story…
Attackers hijacked an Axios maintainer's npm account and published malicious package versions axios@1.14.1 and axios@0.30.4, turning one of npm's most widely used JavaScript libraries into a supply-chain malware delivery channel. The poisoned releases, tracked as MAL-2026-2306 and GHSA-2x9r-6wxq-hrr7, reportedly introduced a hidden dependency, plain-crypto-js@4.2.1, whose postinstall behavior fetched a cross-platform remote access trojan for macOS, Windows, and Linux. The attacker is reported to have used a long-lived classic npm token, changed the maintainer account email, and bypassed the project's normal trusted publishing workflow by releasing directly through the npm CLI.
The malicious packages were available for roughly three hours before removal, but defenders were urged to treat any host or CI runner that installed them as fully compromised. Reported indicators included outbound connections to sfrclak[.]com:8000 and artifacts such as /Library/Caches/com.apple.act.mond on macOS, %PROGRAMDATA%\wt.exe on Windows, and /tmp/ld.py on Linux, with associated infrastructure including 142.11.206.73. Security guidance called for downgrading to axios@1.14.0 or 0.30.3, blocking the command-and-control domain, rebuilding affected systems from known-good images, rotating exposed credentials, and adopting controls such as delayed installation of newly published npm packages and disabling install scripts in CI/CD where feasible.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
AWS Security Blog later referenced the March 2026 Axios compromise as a supply-chain incident that a one-day dependency cooldown would have blocked during its short exposure window.
The poisoned Axios releases were taken down from npm roughly two to three hours after publication, limiting but not eliminating exposure for users who installed them.
After compromising an Axios maintainer's npm credentials, attackers published malicious versions axios@1.14.1 and axios@0.30.4 that added plain-crypto-js and installed a cross-platform RAT on macOS, Windows, and Linux systems.
The attacker published plain-crypto-js@4.2.1 at 23:59 UTC, embedding a postinstall hook used to fetch platform-specific malware.
A separate npm account, nrwise, published a clean decoy package plain-crypto-js@4.2.0 to establish publishing history before the Axios compromise.
Security writeups documented the compromise, identified IOCs including sfrclak[.]com and 142.11.206.73, and advised affected organizations to downgrade Axios, inspect hosts and CI runners, rebuild compromised systems, and rotate credentials.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
12 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourceaws.amazon.com
Open sourcesemgrep.dev
Open sourcelegitsecurity.com
Open sourcelabs.beazley.security
Open sourcestepsecurity.io
Open sourceaikido.dev
Open sourcenpmjs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers hijacked the npm account of Axios maintainer Jason Saayman and published malicious `axios@1.14.1` and `axios@0.30.4`, bypassing the project’s normal GitHub Actions OIDC publishing flow and adding the staged dependency `plain-crypto-js@4.2.1`. That package’s `postinstall` logic fetched platform-specific payloads from `sfrclak[.]com:8000`, deploying a remote access trojan on Windows, macOS, and Linux while deleting installer artifacts and restoring benign-looking package metadata to hinder detection. The poisoned releases were available for roughly three hours before removal, but Axios’s massive downstream use meant developer workstations, CI/CD pipelines, ephemeral builds, and transitive dependencies could all have resolved the malicious versions during the exposure window. Researchers and vendors including Socket, StepSecurity, Elastic, Huntress, Microsoft, Google Threat Intelligence Group, and others said affected systems should be treated as fully compromised because the malware enabled reconnaissance, command execution, persistence on Windows, payload retrieval, and likely credential theft. Multiple reports tied the operation to a North Korea-linked actor—most prominently `UNC1069`, with other vendors using names such as Sapphire Sleet and STARDUST CHOLLIMA—while Axios later confirmed the maintainer had been compromised through a targeted social-engineering campaign involving fake corporate outreach and a bogus meeting workflow. Organizations were urged to roll back to safe versions such as `1.14.0` or `0.30.3`, remove `plain-crypto-js`, rebuild impacted hosts, rotate all accessible secrets, review lockfiles and CI logs, and block traffic to the identified command-and-control infrastructure.
Aug 6, 2026
Attackers compromised an Axios maintainer’s npm account and published malicious `axios` versions **1.14.1** and **0.30.4**. Rather than alter Axios directly, they added the `plain-crypto-js` dependency, whose `postinstall` hook deployed cross-platform malware on affected systems. The maintainer account’s associated email address was changed to a ProtonMail address during the takeover. Elastic Security Labs detected the releases with a proof-of-concept package-monitoring system that analyzed package diffs, and telemetry showed organizations had installed the compromised versions. Axios maintainers subsequently removed the malicious releases. Organizations should identify and remove the affected versions, investigate installations for `plain-crypto-js` postinstall execution, rotate npm credentials where compromise is suspected, and delay adoption of newly released packages while monitoring dependency changes.
Sep 9, 2026
A critical vulnerability in the Axios HTTP client library, tracked as **`CVE-2026-40175`**, allows attackers to turn polluted JavaScript object properties into malicious HTTP headers and abuse outbound requests for **SSRF**, **request smuggling**, and potential **remote code execution**. Researchers said the flaw stems from improper header handling in Axios’s HTTP adapter and unsafe config merging, which can let `Object.prototype` values containing CRLF characters be injected into requests. The issue can be chained with prototype pollution in other npm packages to target internal services, including the AWS EC2 metadata endpoint at `169.254.169.254`, potentially bypassing **IMDSv2** and exposing cloud credentials or broader infrastructure. A public proof-of-concept was released alongside disclosure, raising urgency for defenders even though active exploitation had not been confirmed at the time of reporting. The flaw affects Axios versions before **`1.13.2`**, while maintainers said **`1.15.0`** introduces strict header validation that blocks CRLF-based header injection; organizations were urged to upgrade and audit dependencies such as **`body-parser`**, **`qs`**, and **`minimist`** for prototype pollution paths. One report cited internet-wide estimates of more than **48,000** potentially exposed instances, underscoring the risk of unauthorized internal access and possible full cloud compromise.
Jun 29, 2026