Malicious Axios npm Releases Delivered Malware Through Added Dependency

Attackers compromised an Axios maintainer’s npm account and published malicious axios versions 1.14.1 and 0.30.4. Rather than alter Axios directly, they added the plain-crypto-js dependency, whose postinstall hook deployed cross-platform malware on affected systems. The maintainer account’s associated email address was changed to a ProtonMail address during the takeover.

Elastic Security Labs detected the releases with a proof-of-concept package-monitoring system that analyzed package diffs, and telemetry showed organizations had installed the compromised versions. Axios maintainers subsequently removed the malicious releases. Organizations should identify and remove the affected versions, investigate installations for plain-crypto-js postinstall execution, rotate npm credentials where compromise is suspected, and delay adoption of newly released packages while monitoring dependency changes.