The popular HTTP client known as Axios has suffered a supply chain attack after two newly published versions of the npm package introduced a malicious dependency.
Versions 1.14.1 and 0.30.4 of Axios have been found to inject “plain-crypto-js” version 4.2.1 as a fake dependency.
According to StepSecurity, the two versions were published using the compromised npm credentials of the primary Axios maintainer (“jasonsaayman”), allowing the attackers to bypass the project’s GitHub Actions CI/CD pipeline.
“Its sole purpose is to execute a postinstall script that acts as a cross-platform remote access trojan (RAT) dropper, targeting macOS, Windows, and Linux,” security researcher Ashish Kurmi said. “The dropper contacts a live command and control server and delivers platform-specific second-stage payloads. After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection.”
Users who have Axios versions 1.14.1 or 0.30.4 installed are required to rotate their secrets and credentials with immediate effect, and downgrade to a safe version (1.14.0 or 0.30.3). The malicious versions, as well as “plain-crypto-js,” are no longer available for download from npm.
With more than 83 million weekly downloads, Axios is one of the most widely used HTTP clients in the JavaScript ecosystem across frontend frameworks, backend services, and enterprise applications.
“This was not opportunistic,” Kurmi added. “The malicious dependency was staged 18 hours in advance. Three separate payloads were pre-built for three operating systems. Both release branches were hit within 39 minutes. Every trace was designed to self-destruct.”
The timeline of the attack is as follows –
According to StepSecurity, the threat actor behind the campaign is said to have compromised the npm account of “jasonsaayman” and changed its registered email address to a Proton Mail address under their control (“ifstap@proton.me”). The “plain-crypto-js” was published by an npm user named “nrwise” with the email address “nrwise@proton.me.”
It’s believed that the attacker obtained a long-lived classic npm access token for the account to take control and directly publish poisoned versions of Axios to the registry.
The embedded malware, for its part, is launched via an obfuscated Node.js dropper (“setup.js”) and is designed to branch into one of three attack paths based on the operating system –
“Each platform sends a distinct POST body to the same C2 URL — packages.npm.org/product0 (macOS), packages.npm.org/product1 (Windows), packages.npm.org/product2 (Linux),” StepSecurity said. “This allows the C2 server to serve a platform-appropriate payload in response to a single endpoint.”
The downloaded second-stage binary for macOS is a C++ RAT that fingerprints the system and beacons to a remote server every 60 seconds to retrieve commands for subsequent execution. It supports capabilities to run additional payloads, execute shell commands, enumerate the file system, and terminate the RAT.
SafeDep’s analysis of the Linux RAT has revealed that it supports the same commands as its macOS counterpart. The absence of a persistence mechanism means that the malware does not survive across reboots. This indicates that the attack is either geared towards quick data exfiltration or leverages the RAT’s ability to run binaries and shell commands to deploy persistence.
“The attack is notable for its restraint. No axios source files were modified, making traditional diff-based code review less likely to catch it,” SafeDep said. “The malicious behavior lives entirely in a transitive dependency, triggered automatically by npm’s postinstall lifecycle.”
Once the main payload is launched, the Node.js malware also takes steps to perform three forensic cleanup steps by removing the postinstall script from the installed package directory, deleting the “package.json” the references the postinstall hook to launch the dropper, and renaming “package.md” to “package.json.”
It’s worth noting that the “package.md” file is included in “plain-crypto-js” and is a clean “package.json” manifest without the postinstall hook that triggers the entire attack. In switching the package manifests, the idea is to avoid raising any red flags during post-infection inspection of the package.
“Neither malicious version contains a single line of malicious code inside Axios itself,” StepSecurity said. “Instead, both inject a fake dependency, plain-crypto-js@4.2.1, a package that is never imported anywhere in the Axios source, whose only purpose is to run a postinstall script that deploys a cross-platform remote access trojan (RAT).”
Users are advised to perform the following actions to ascertain compromise –
Socket, in its own analysis of the attack, said identified two additional packages distributing the same malware through vendored dependencies –
In the case of “@shadanai/openclaw,” the package vendors the malicious “plain-crypto-js” payload directly (e.g., @shadanai/openclaw/files/2026.3.31-1/dist/extensions/slack/node_modules/plain-crypto-js/setup.js). On the other hand, “@qqbrowser/openclaw-qbot@0.0.130,” ships a tampered “axios@1.14.1” in its “node_modules/” folder with “plain-crypto-js” injected as a dependency.
“The real axios has only three dependencies (follow-redirects, form-data, proxy-from-env),” the supply chain security company said. “The addition of plain-crypto-js is unambiguous tampering. When npm processes this vendored axios, it installs plain-crypto-js and triggers the same malicious postinstall chain.”
New 2026 Ponemon research reveals where mature identity programs still fall short and what leading organizations are doing to close the gap.
AI agents need identity, but most teams are still figuring out how to implement it. This session cuts through the noise with a practical, production-ready framework.
Get the latest news, expert insights, exclusive resources, and strategies from industry leaders – all for free.
