Malicious Axios npm Releases Delivered Cross-Platform RAT in Supply-Chain Attack
Summary
Two malicious Axios versions containing a post-install RAT dropper were published to NPM after attackers compromised the maintainer’s account. Google attributes the attack to suspected North Korean actor UNC1069; the releases were removed about three hours later.
Key points
- Axios versions 1.14.1 and 0.30.4 were published on March 31, 2026, and removed about three hours later.
- The releases included a phantom plain-crypto-js dependency whose post-install script delivered platform-specific payloads for Windows, macOS and Linux.
- The payloads enabled remote shell execution, code injection, directory and process enumeration, and system reconnaissance; the malware also attempted to erase installation artifacts.
- Attackers reportedly compromised Axios maintainer @jasonsaayman's NPM account and used a long-lived access token to publish the packages, bypassing the configured OIDC publishing workflow.
- Wiz estimated the malicious versions were downloaded by roughly 3% of Axios users during their availability.
- Google attributed the attack to suspected North Korean actor UNC1069; the article says the full impact remains unclear.
- Huntress advised affected organizations to treat environments that installed the versions as compromised, audit dependencies, rotate accessible credentials, and scan for malware artifacts.
Article Details
- Victim Organization
- Axios project
- Incident Type
- NPM supply-chain attack involving compromised Axios releases and a malicious dependency
- Incident Date
- 2026-03-31
- Operational Impact
- Malicious Axios versions 1.14.1 and 0.30.4 were available for roughly three hours and were downloaded by an estimated 3% of the Axios userbase, according to Wiz. The payloads enabled remote shell execution, code injection, and system reconnaissance. The article says downstream exposure may be broad but does not confirm the number of infected systems or any operational disruption.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsAttackers reportedly compromised the Axios maintainer's NPM account and used a long-lived access token to publish malicious package versions.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious code was distributed through compromised Axios package releases and a staged dependency published to the NPM registry.
People
Ilkka TurunenSonatype field CTO who commented on the supply-chain and downstream risks of the attack.Isaac EvansSemgrep founder and CEO who noted that IDE extensions could pull the affected dependency even for developers using pinned versions and lockfiles.Ismael ValenzuelaArctic Wolf vice president who commented on the potential downstream exposure from malicious code in a widely used package.John HammondHuntress senior principal security researcher who advised treating environments that installed the malicious packages as compromised.John HultquistGoogle Threat Intelligence Group chief analyst who said GTIG attributed the attack to a suspected North Korean threat actor tracked as UNC1069.Tomislav PericinReversingLabs chief software architect who commented on the attack's planning and operational sophistication.
Threat Actors
Malware
Vendors
GitHublong-lived access token to publish the backdoor package versions directly via the NPM CLI, bypassing the GitHub Actions OIDC-based CI/CD publishing workflow.npmMalicious versions of the highly popular Axios NPM library were distributed to millions in a fresh supply chain attack blamed on North Korean hackers.
Products
AxiosMalicious versions of the highly popular Axios NPM library were distributed to millions in a fresh supply chain attack blamed on North Korean hackers.GitHub Actionsaccess token to publish the backdoor package versions directly via the NPM CLI, bypassing the GitHub Actions OIDC-based CI/CD publishing workflow.plain-crypto-jsA clean version of plain-crypto-js dependency used in the attack was published 18 hours before the attack, “to establish NPM publishing history, so the package does not appear as a zero-history account during later