Loading story…
Attackers compromised an Axios maintainer’s npm account and published malicious axios versions 1.14.1 and 0.30.4. Rather than alter Axios directly, they added the plain-crypto-js dependency, whose postinstall hook deployed cross-platform malware on affected systems. The maintainer account’s associated email address was changed to a ProtonMail address during the takeover.
Elastic Security Labs detected the releases with a proof-of-concept package-monitoring system that analyzed package diffs, and telemetry showed organizations had installed the compromised versions. Axios maintainers subsequently removed the malicious releases. Organizations should identify and remove the affected versions, investigate installations for plain-crypto-js postinstall execution, rotate npm credentials where compromise is suspected, and delay adoption of newly released packages while monitoring dependency changes.
Trace attribution and downstream blast radius.
10 events from the most recent confirmed update back to the earliest known activity.
TeamPCP allegedly used PyPI publishing credentials stolen through the Trivy compromise to publish malicious LiteLLM versions targeting SSH keys, cloud credentials, API keys, and wallet data.
TeamPCP reportedly compromised the aquasecurity/trivy-action GitHub Action and injected a credential stealer that harvested CI/CD secrets.
Elastic Security Labs reported significant code and behavioral overlap between the macOS RAT delivered through the malicious Axios dependency and WAVESHAPER, a C++ backdoor Mandiant associates with the DPRK-linked UNC1069 cluster.
Elastic open-sourced supply-chain-monitor, a proof-of-concept tool that monitors selected npm and PyPI releases, generates static package-diff reports without executing package code, and uses LLM-based classification.
TeamPCP reportedly compromised the telnyx PyPI package by adding malicious code to _client.py, including WAV-file steganography, Base64 obfuscation, a Windows persistence component disguised as msbuild.exe, and exfiltration to a hardcoded command-and-control server.
Elastic Security Labs published technical analysis of the reported Axios attack chain, malware, and command-and-control protocol, along with detection and hunting guidance for Linux, Windows, and macOS.
After notification, Axios maintainers reportedly removed the malicious package versions from npm.
Elastic's proof-of-concept supply-chain-monitor generated a Slack alert identifying npm package axios version 0.30.4 as malicious. Elastic Defend also generated alerts on a host that installed the malicious package.
The compromised Axios releases added the plain-crypto-js dependency rather than modifying Axios source code directly. Its postinstall hook reportedly deployed cross-platform malware, and Elastic telemetry showed affected organizations had installed the package.
Attackers reportedly took over an Axios maintainer's npm account, changed its associated email address to an attacker-controlled ProtonMail address, and published malicious Axios releases 1.14.1 and 0.30.4.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers hijacked an Axios maintainer's npm account and published malicious package versions **`axios@1.14.1`** and **`axios@0.30.4`**, turning one of npm's most widely used JavaScript libraries into a supply-chain malware delivery channel. The poisoned releases, tracked as **`MAL-2026-2306`** and **`GHSA-2x9r-6wxq-hrr7`**, reportedly introduced a hidden dependency, **`plain-crypto-js@4.2.1`**, whose `postinstall` behavior fetched a cross-platform remote access trojan for macOS, Windows, and Linux. The attacker is reported to have used a long-lived classic npm token, changed the maintainer account email, and bypassed the project's normal trusted publishing workflow by releasing directly through the npm CLI. The malicious packages were available for roughly three hours before removal, but defenders were urged to treat any host or CI runner that installed them as fully compromised. Reported indicators included outbound connections to **`sfrclak[.]com:8000`** and artifacts such as **`/Library/Caches/com.apple.act.mond`** on macOS, **`%PROGRAMDATA%\wt.exe`** on Windows, and **`/tmp/ld.py`** on Linux, with associated infrastructure including **`142.11.206.73`**. Security guidance called for downgrading to **`axios@1.14.0`** or **`0.30.3`**, blocking the command-and-control domain, rebuilding affected systems from known-good images, rotating exposed credentials, and adopting controls such as delayed installation of newly published npm packages and disabling install scripts in CI/CD where feasible.
Aug 21, 2026
Attackers hijacked the npm account of Axios maintainer Jason Saayman and published malicious `axios@1.14.1` and `axios@0.30.4`, bypassing the project’s normal GitHub Actions OIDC publishing flow and adding the staged dependency `plain-crypto-js@4.2.1`. That package’s `postinstall` logic fetched platform-specific payloads from `sfrclak[.]com:8000`, deploying a remote access trojan on Windows, macOS, and Linux while deleting installer artifacts and restoring benign-looking package metadata to hinder detection. The poisoned releases were available for roughly three hours before removal, but Axios’s massive downstream use meant developer workstations, CI/CD pipelines, ephemeral builds, and transitive dependencies could all have resolved the malicious versions during the exposure window. Researchers and vendors including Socket, StepSecurity, Elastic, Huntress, Microsoft, Google Threat Intelligence Group, and others said affected systems should be treated as fully compromised because the malware enabled reconnaissance, command execution, persistence on Windows, payload retrieval, and likely credential theft. Multiple reports tied the operation to a North Korea-linked actor—most prominently `UNC1069`, with other vendors using names such as Sapphire Sleet and STARDUST CHOLLIMA—while Axios later confirmed the maintainer had been compromised through a targeted social-engineering campaign involving fake corporate outreach and a bogus meeting workflow. Organizations were urged to roll back to safe versions such as `1.14.0` or `0.30.3`, remove `plain-crypto-js`, rebuild impacted hosts, rotate all accessible secrets, review lockfiles and CI logs, and block traffic to the identified command-and-control infrastructure.
Aug 6, 2026
A critical vulnerability in the Axios HTTP client library, tracked as **`CVE-2026-40175`**, allows attackers to turn polluted JavaScript object properties into malicious HTTP headers and abuse outbound requests for **SSRF**, **request smuggling**, and potential **remote code execution**. Researchers said the flaw stems from improper header handling in Axios’s HTTP adapter and unsafe config merging, which can let `Object.prototype` values containing CRLF characters be injected into requests. The issue can be chained with prototype pollution in other npm packages to target internal services, including the AWS EC2 metadata endpoint at `169.254.169.254`, potentially bypassing **IMDSv2** and exposing cloud credentials or broader infrastructure. A public proof-of-concept was released alongside disclosure, raising urgency for defenders even though active exploitation had not been confirmed at the time of reporting. The flaw affects Axios versions before **`1.13.2`**, while maintainers said **`1.15.0`** introduces strict header validation that blocks CRLF-based header injection; organizations were urged to upgrade and audit dependencies such as **`body-parser`**, **`qs`**, and **`minimist`** for prototype pollution paths. One report cited internet-wide estimates of more than **48,000** potentially exposed instances, underscoring the risk of unauthorized internal access and possible full cloud compromise.
Jun 29, 2026