Axios npm Supply Chain Attack: Rogue Dependency Hijacks CI/CD

On March 31 2026, the popular JavaScript library Axios—downloaded over 100 million times each week—was breached through two malicious versions published to the npm registry. The attacker did not inject malicious code into Axios itself; instead, a rogue dependency named plain-crypto-JS was added to the release. This supply‑chain attack targets developer machines and CI/CD servers, allowing the attacker to infiltrate build pipelines and production environments.

“The two different malicious versions of Axios were published to the MPM registry that contained a highly sophisticated supply chain attack that compromises developer machines and CI/CD servers.”

“The scariest thing is that Axios itself contains zero lines of bad source code.”

Identification and Remediation

Developers should first inspect their package.json for the compromised Axios versions. If those versions appear, the next step is to look inside node_modules for a folder named plain-crypto-JS. Presence of this folder indicates the malicious dependency has been installed.

System‑specific commands can then be run to detect the embedded Remote Access Trojan (RAT). Simply deleting the RAT is not enough; all exposed API keys and tokens—such as AWS or OpenAI credentials—must be rotated immediately. Comprehensive remediation guidance is available from Step Security.

Attack Mechanism

The breach originated from a compromised npm maintainer account. Unlike typical automated releases, the attacker used a Proton Mail address to publish the malicious packages, bypassing the usual GitHub action workflow.

The rogue plain-crypto-JS package contains a post‑install script that functions as a rat dropper. When npm install triggers the script, it first detects the host operating system, contacts a command‑and‑control server, and fetches a second‑stage payload tailored to that OS. The payload writes itself to disk, establishes remote access, exfiltrates credentials, and then erases its own traces—including the post‑install script and modifications to package.json—so that npm audit reports no issues.

“The script will first detect the system you're running, then reach out to a remote command and control server where it can fetch a second stage payload tailored to your operating system.”

“It deletes itself, it deletes the package JSON and removes the post install script among other things so that the end result is running npm audit that doesn't raise any red flags.”

Rat Dropper Lifecycle

1. Trigger – npm install runs the post‑install script in plain-crypto-JS.
2. Detection – The script identifies the host OS.
3. Fetch – It contacts a C2 server to download a matching second‑stage payload.
4. Execution – The payload is written to disk and executed, establishing remote access.
5. Exfiltration – The RAT steals credentials (e.g., AWS, OpenAI keys) and other sensitive files.
6. Cleanup – The script removes itself, alters package.json, and deletes the post‑install script, evading audit tools.

Security Remediation

• Verify package.json for the compromised Axios versions.
• Search node_modules for plain-crypto-JS.
• Run the recommended detection commands for your operating system.
• Delete the RAT and rotate every API key and token immediately.
• Follow Step Security’s step‑by‑step remediation guide for additional hardening measures.