The axios npm Compromise Explained

Video transcript

On March 31, 2026, two axios releases installed a remote access trojan. No bug in axios was needed.

Axios, a JavaScript HTTP client, has about 100 million weekly npm downloads, per Socket.

Posing as a company founder, attackers got the maintainer onto a Teams call, where a fake update installed the trojan. They hijacked his npm account and published two releases.

Each release added one dependency, plain crypto JS. Its postinstall script dropped a backdoor for macOS, Windows or Linux, then cleaned up after itself.

Exposure came down to a window of about three hours. On a loose version range, any fresh install then could pull a bad version.

Microsoft attributes it to Sapphire Sleet, a North Korean state actor whose primary motivation is stealing crypto wallets. Google points to a North Korea-nexus actor.

Two factor authentication protected the login, not the laptop. Install scripts are code execution. Microsoft advises turning them off where possible and pinning exact versions.

Search lockfiles for the bad versions, check CI and network logs, treat affected hosts as compromised, rotate secrets and pin axios exactly.

Socket flagged the dependency before the first bad axios release went out. The gap was matching it to your builds. Guardian's Managed Security checks every disclosure against what you run.

Read the full article for the timeline and checks, or talk to Guardian at guardian.security.

The axios library is an HTTP client for JavaScript with about 100 million weekly npm downloads, per Socket.

On March 31, 2026, two axios releases installed a remote access trojan on machines that pulled them during a window of about three hours.

The attacker did not need a bug in axios. They went through the lead maintainer's computer.

What Happened

The attack began about two weeks earlier, according to the post-mortem by lead maintainer Jason Saayman.

The attackers posed as a company founder, copying the founder's likeness. They invited him to a Slack workspace branded to match, then to a Microsoft Teams call.

On the call, he was told a system component was out of date. The component he installed was the trojan.

He had two-factor authentication on. He noted that a remote access trojan hands the attacker full control of the machine.

From there, the attacker took over his npm account and published two releases:

• axios 1.14.1 at 00:21 UTC on March 31
• axios 0.30.4 around 01:00 UTC

The attacker deleted community issues reporting the problem. A collaborator contacted npm at 01:38 UTC, and both versions were removed at 03:15 UTC.

How the Attack Worked

One added dependency

Each release added a single new dependency, plain-crypto-js 4.2.1. Microsoft notes that axios never imports it.

A clean 4.2.0 had been published on March 30. Socket describes it as a copy of the crypto-js library with no payload.

An install-time dropper

Version 4.2.1 carried a postinstall script, so it ran during npm install with no other action. It then branched by operating system, per Socket:

• macOS: a binary saved under /Library/Caches, named like an Apple daemon.
• Windows: PowerShell copied to pose as Windows Terminal, plus a hidden script.
• Linux: a Python script dropped in /tmp and run in the background.

Each path called the same server, sfrclak[.]com on port 8000. The dropper then deleted itself and swapped in a clean package.json, so the folder looked normal.

Google's Threat Intelligence Group identified the backdoor as WAVESHAPER.V2, with variants for each system. It checks in every 60 seconds and can run shell commands, list directories and inject binaries.

Around the release pipeline

Socket noted that the new release had no matching tag in the axios GitHub repository.

Socket also reported early discussion of a long-lived npm token, still in use alongside trusted publishing.

Who Was Exposed

Exposure came down to timing. Per the post-mortem, you are fine if you were pinned to a clean version and ran no fresh install between 00:21 and 03:15 UTC on March 31.

Google's report puts the end of that window at 03:20 UTC, five minutes later.

Version ranges widened the net. Socket noted that projects on ^1.14.0 or ^0.30.0 would pull a bad version on their next install.

That covers developer laptops, CI runners and build servers. The post-mortem tells affected users to rotate every secret, token and credential on those machines, including CI secrets.

For crypto teams, the attribution matters. Microsoft attributes the attack to Sapphire Sleet, a North Korean state actor whose "primary motivation" is stealing cryptocurrency wallets.

Google attributes it to UNC1069, a financially motivated North Korea-nexus actor active since at least 2018. Our Lazarus Group playbook covers how these groups operate.

The fake meeting lure is a familiar pattern. See fake Zoom meeting attacks on crypto teams.

None of the sources we read reports a dollar loss or a count of infected machines.

Timeline

What It Shows

2FA protects the login, not the laptop. Once the trojan ran, the attacker had the maintainer's machine and what it could reach.

Publishing from a personal account was avoidable. The post-mortem says so, and the project is adopting OIDC publishing and an immutable release setup.

Install scripts are code execution. Microsoft recommends npm ci --ignore-scripts where possible, or turning install scripts off by default.

Ranges pull in releases nobody reviewed. Microsoft advises pinning exact versions and restricting dependency bots such as Dependabot for axios.

Detection was fast; matching was the gap. Socket flagged the dependency before the first bad axios release went out. Each team still had to learn whether its own builds pulled it.

Checks to run

• Search every lockfile for axios 1.14.1, axios 0.30.4 and plain-crypto-js.
• Check CI logs for installs between 00:21 and 03:20 UTC on March 31, the wider window.
• Search network logs for sfrclak[.]com and 142.11.206.73 on port 8000.
• Treat affected hosts as compromised: restore them and rotate their secrets, as Google advises.
• Pin axios exactly. The post-mortem names 1.14.0 and 0.30.3 as safe.

For build pipeline controls, see our guide to dApp frontend supply chain security.

How Guardian Matches Advisories

Guardian's Managed Security includes advisory matching: "Every disclosure checked against what you run."

Guardian ingests vulnerability disclosures in real time and matches them against your system. Where one reaches you, an engineer confirms the exposure and works with you to patch it.

The axios compromise is one of the examples on the Managed Security page.

Teams that publish their own packages can also get an SDK audit. It reviews what ships to the registry versus the repo, including install scripts and dependencies.

It also checks who can publish, whether 2FA and provenance are enforced, and how a bad version gets pulled.

Frequently Asked Questions

Which axios versions were compromised?

Versions 1.14.1 and 0.30.4, published on March 31, 2026 and removed about three hours later. Both added a malicious dependency, plain-crypto-js 4.2.1. The maintainer's post-mortem names 1.14.0 and 0.30.3 as the safe versions to roll back to.

Am I affected by the axios npm compromise?

Likely only if a machine or CI job ran a fresh install from 00:21 to 03:15 UTC on March 31, 2026, per the maintainer (03:20, per Google). Check lockfiles for both versions and plain-crypto-js, and network logs for sfrclak[.]com.

Who was behind the axios attack?

Google attributes it to UNC1069, a financially motivated North Korea-nexus actor. Microsoft attributes it to Sapphire Sleet, a North Korean state actor whose primary motivation is stealing cryptocurrency wallets.

Why didn't two-factor authentication stop it?

The maintainer had 2FA on, but the trojan on his computer gave the attacker full control of the machine. Socket also reported early discussion of a long-lived npm token, still in use alongside trusted publishing.

Sources

• axios (GitHub): Post Mortem: axios npm supply chain compromise, by Jason Saayman (April 2, 2026)
• Socket: Supply Chain Attack on Axios Pulls Malicious Dependency from npm (March 31, 2026)
• Google Threat Intelligence Group: North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack (March 31, 2026)
• Microsoft Security Blog: Mitigating the Axios npm supply chain compromise (April 1, 2026)
• Guardian: Managed Security
• Guardian: SDK Security Audit