Axios npm Supply Chain Compromise – Guidance for Azure Pipelines Customers

On March 31, 2026, malicious versions of the Axios npm package (1.14.1 and 0.30.4) were published as part of a supply chain attack. These versions included a hidden dependency (plain-crypto-js@4.2.1) that connected to attacker-controlled C2 infrastructure. Azure Pipelines itself was not compromised, but pipelines using self-hosted agents, custom tasks, third-party extensions, or containerized environments may have been exposed. Recommended actions include reviewing pipeline logs for the affected versions, rotating credentials used by affected runs, reimaging self-hosted agents, clearing dependency caches, and treating artifacts from compromised runs as untrusted. Best practices to reduce future risk include pinning dependency versions, using lockfiles with deterministic installs (npm ci), and limiting secret scope in pipelines.