Late March 2026, security vendors and the open-source community flagged a live supply-chain compromise of Axios—the ubiquitous JavaScript HTTP client on npm. Axios routinely sees on the order of hundreds of millions of weekly downloads, so any poisoned release has an enormous potential blast radius across applications, libraries, and build pipelines.
What happened
According to analyses from Step Security, Socket, and press coverage, an attacker compromised the npm account of Axios’s primary maintainer, changed the account email to an anonymous ProtonMail address, and published malicious package versions manually—bypassing the project’s usual GitHub Actions release path. The trojaned builds introduced a dependency on plain-crypto-js: researchers described a decoy publish ([email protected]) with benign code to establish registry history, followed by [email protected] shortly before midnight UTC on 30 March 2026, which delivered a cross-platform remote access Trojan (RAT) affecting Windows, Linux, and macOS.
Impact: developers and secrets, not a single “breach database”
This incident is not primarily a case of a company losing a centralized customer table. The risk model is developer workstations, build agents, and cloud credentials: reporting tied the malware to reconnaissance and theft from sensitive paths (e.g., .ssh, .aws), with network indicators such as outbound contact to infrastructure associated with sfrclak.com (IP 142.11.206.73 cited in public writeups). Any organization that installed the bad axios versions during the exposure window should assume secret material may have been copied until forensics proves otherwise.
Immediate actions
- Pin or downgrade to known-good releases per vendor guidance (e.g.
[email protected]or[email protected]—avoid the trojaned lines such as1.14.1/0.30.4called out in analyses). - Rotate credentials: npm tokens, CI secrets, cloud API keys, and SSH keys that could have been present on affected hosts.
- Hunt IOCs: review egress logs for the reported C2; check for suspicious files or processes noted in technical posts (OS-specific paths have been cited in industry articles).
- Rebuild from clean lockfiles after verifying dependency trees.
Why it matters for “breach” tracking
Supply-chain incidents sit alongside traditional enterprise data breaches: they can precede mass credential theft, downstream compromises, and espionage-style access to source and infrastructure. We record this as a 2026 supply-chain security incident on Axios (npm) on BreachHistory with structured references and dates.
Sources: Step Security, Socket, iTnews, Open Source Malware