Axios npm Package Compromised in Supply Chain Attack

On March 31, 2026, two versions of the Axios npm library (axios@1.14.1 and axios@0.30.4) were compromised via a hijacked maintainer account and found to contain a Remote Access Trojan. The malicious packages included a poisoned transitive dependency (plain-crypto-js@4.2.1), a typosquat of crypto-js. Socket's automated scanner detected the threat within six minutes. Projects using unpinned caret ranges silently pulled in the malware. The Axios team has deprecated the affected versions and is investigating a long-lived npm token as the likely attack vector. Security experts recommend pinning dependencies, setting ignore-scripts=true in .npmrc, and considering leaner HTTP client alternatives like fetch, got, or ky.