On March 31, 2026, one of the most widely used npm packages was compromised: Axios, a JavaScript HTTP client library with around 100 million downloads per week. The poisoned versions axios@1.14.1 and axios@0.30.4 contained a Remote Access Trojan (RAT) that works on macOS, Windows, and Linux.
How the Attack Unfolded
The attackers took over the npm account of the main maintainer "jasonsaayman", changed the registered email address to an anonymous ProtonMail account, and published the infected packages manually via the npm CLI. The regular CI/CD build process via GitHub Actions was completely bypassed.
Instead of manipulating the Axios code directly, the attackers added a new dependency: "plain-crypto-js@4.2.1". This package existed solely as a delivery mechanism. Its post-install script contacts an external server, downloads a second payload, and installs platform-specific malware:
- macOS: Disguises itself as a system daemon
- Windows: Uses PowerShell for persistence
- Linux: Falls back to a Python backdoor
Operational Sophistication
According to StepSecurity CTO Ashish Kurmi, the attack was precisely planned: The malicious dependency was placed 18 hours in advance. Three separate payloads for three operating systems were pre-built. Both release branches were infected within 39 minutes. All traces were designed for self-destruction.
Attribution
Google's Threat Intelligence Group (GTIG) linked the attack to UNC1069, a suspected North Korean actor. The attack fits into a series of npm supply chain attacks, including the Shai-Hulud campaigns of 2025.
What Developers Should Do
Anyone who installed axios@1.14.1 or axios@0.30.4 should consider their system compromised. This means: remove dependencies, rotate credentials, and in some cases completely reimage machines.
Sources: The Register (31.03.2026), StepSecurity Blog, Aikido Security Blog, Socket.dev, Google GTIG.