2026 Axios (npm) — supply-chain compromise; malicious plain-crypto-js RAT

In late March 2026, the npm package axios—one of the most-downloaded JavaScript HTTP clients—was compromised in a supply-chain attack. Researchers (e.g., Step Security, Socket) reported that an attacker took control of the primary maintainer’s npm account, changed the registered email to an anonymous ProtonMail address, and published malicious package versions outside the project’s normal GitHub Actions pipeline. Poisoned releases (notably [email protected] and [email protected] per industry guidance) added a dependency on [email protected], described as a cross-platform remote-access Trojan (RAT) dropper with obfuscation and anti-analysis behavior. A staged tactic was reported: a prior [email protected] release appeared benign to build registry credibility before 4.2.1 delivered the payload shortly before midnight UTC on March 30, 2026. Impact is developer- and build-pipeline–centric: infected machines risk credential and secret theft (reporting cited interest in .ssh, .aws, and similar paths), not a centralized consumer database leak. Mitigations advised included pinning to safe versions (e.g., [email protected] / [email protected] per public guidance), rotating npm and cloud credentials, and hunting for IOCs such as outbound connections to infrastructure associated with the campaign (e.g., sfrclak.com / 142.11.206.73 cited in reporting). Weekly download figures in the hundreds of millions imply an extremely large potential blast radius for any install of the trojanized versions.