Axios library suffers supply chain attack, hackers use stolen npm tokens to implant remote trojans, affecting approximately 80% of cloud environments.

DeepFlowTech · 2026-04-02T05:16:42+00:00

Recently, the npm access token of Axios maintainers was stolen by attackers, who released malicious versions containing trojans, affecting macOS, Windows, and Linux systems. Although security measures have been implemented for the project, the existence of traditional tokens allowed attackers to bypass defenses, resulting in at least 135 systems being compromised.

DeepFlowTech

2026-04-02 05:16:42

Abstract generation in progress

Deep Tide TechFlow message, April 02, according to VentureBeat, attackers stole an npm access token of the lead maintainer of the JavaScript’ most popular HTTP client library, Axios, and used that token to publish two malicious versions containing cross-platform remote access trojans (RATs) (axios@1.14.1 and axios@0.30.4), targeting macOS, Windows, and Linux systems. The malicious packages were removed from the npm registry about 3 hours after being published.

According to data from the security company Wiz, Axios is downloaded more than 100 million times per week and is present in about 80% of cloud and code environments. Security company Huntress detected the first wave of infections just 89 seconds after the malicious packages went live, and confirmed at least 135 systems were compromised during the exposure window.

It’s worth noting that the Axios project had previously deployed modern security measures such as an OIDC trusted publishing mechanism and SLSA provenance proofs, but the attackers completely bypassed these defenses. The investigation found that while the project configured OIDC, it still retained the traditional long-lived NPM_TOKEN. When both coexisted, npm defaulted to the traditional token, enabling the attackers to complete the release without having to bypass OIDC.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.