Axios Hijacked on npm — Malicious Versions Dropped a Cross-Platform RAT on Millions of Machines

Two versions of Axios — the HTTP client installed on virtually every Node.js project in existence — were backdoored early this morning. Versions 1.14.1 and 0.30.4 contained a hidden dependency called plain-crypto-js@4.2.1 that silently installed a remote access trojan on every machine that ran npm install.

The library has 83 million weekly downloads. The malicious packages were live from approximately 00:21 to 03:15 UTC on March 31, 2026.

How the attack worked

The attacker compromised the npm classic access token of Jason Saayman, Axios’s lead maintainer, and used it to publish the two poisoned versions. The malicious dependency executed an obfuscated setup.js file via npm’s postinstall hook — meaning the RAT dropped the instant you installed the package, before you ever imported it in code.

The payload was platform-aware:

• macOS: AppleScript fetched a C++ binary from sfrclak.com:8000, saved it to /Library/Caches/com.apple.act.mond, and executed it via /bin/zsh
• Windows: PowerShell downloaded a RAT script, created %PROGRAMDATA%\system.bat, and added a Registry Run key for persistence
• Linux: A Python RAT script landed at /tmp/ld.py and ran under nohup

All three variants beaconed to a C2 server every 60 seconds, capable of executing arbitrary commands, enumerating files and processes, and injecting binaries into memory on Windows.

North Korean attribution signals

Elastic Security Labs flagged overlap between the macOS binary and WAVESHAPER, a C++ backdoor that Mandiant attributes to UNC1069 — a North Korean threat cluster. The attacker used Proton Mail addresses (ifstap@proton.me, nrwise@proton.me) and the malware self-deleted after execution, replacing package.json with a clean version to cover its tracks.

What to do right now

If you ran npm install between 00:21 and 03:15 UTC today, check immediately:

1. Lock to safe versions: downgrade to axios@1.14.0 or axios@0.30.3
2. Delete the payload: remove plain-crypto-js from node_modules
3. Hunt for artifacts: check for /Library/Caches/com.apple.act.mond (macOS), %PROGRAMDATA%\wt.exe (Windows), or /tmp/ld.py (Linux)
4. Rotate everything: npm tokens, AWS keys, SSH keys, cloud credentials, CI/CD secrets, .env values — all of it. The RAT had full system access.
5. Block egress: firewall sfrclak[.]com across your infrastructure

If any artifact exists on a machine, treat that machine as fully compromised.

The bigger problem

This is the second major npm supply chain attack in 2026. The JavaScript ecosystem’s trust model — where a single compromised token can push code to millions of machines instantly — remains fundamentally broken. Axios had no OIDC-trusted publishing, no mandatory 2FA enforcement on the maintainer account, and no publish delay that would have given the community time to catch this before it shipped.

The community is now pushing for version 1.14.2 via OIDC-trusted publishing. Until then, pin your dependencies and audit your lockfiles.