Open Source ·
Axios npm account shipped RAT
A compromised axios maintainer account published malicious npm versions 1.14.1 and 0.30.4 on March 31, 2026. Both releases injected plain-crypto-js 4.2.1, whose install path delivered a multi-platform RAT and exposed machines that installed the brief releases.
Just after midnight UTC on March 31, 2026, an attacker with access to the lead maintainer's npm account published two malicious versions of axios, the most widely used HTTP client in the JavaScript ecosystem. The window was narrow, less than three hours, but the dependency graph beneath axios is enormous, and one of the projects that pulled the bad version was OpenAI's macOS app-signing pipeline.
The axios project later published a postmortem describing the entry point as a compromised maintainer workstation reached through a targeted social engineering campaign and a remote access trojan. The attacker did not bother rewriting the library's public API. Instead, axios 1.14.1 and 0.30.4 were published with a new dependency on plain-crypto-js@4.2.1, a helper package the same actor had pushed to npm the day before. A normal fresh install during the window pulled the poisoned axios, then pulled the malicious helper, which installed a multi-platform RAT covering macOS, Windows, and Linux. Operators of affected machines were told to watch for outbound traffic to sfrclak.com or 142.11.206.73 on TCP port 8000.
The clock ran fast. Axios 1.14.1 went live at 00:21 UTC, 0.30.4 followed around 01:00 UTC, community detections started almost immediately, an axios collaborator opened a deprecation PR at 01:38 UTC, and npm pulled the two axios versions by 03:15 UTC, with plain-crypto-js removed at 03:29 UTC. Socket reported a week later that the malicious axios had been pulled into OpenAI's macOS app-signing GitHub Actions workflow, which used a floating tag with no minimumReleaseAge set. OpenAI responded by revoking and rotating its macOS code-signing certificate and rebuilding ChatGPT Desktop, Codex, and Atlas with new credentials, setting a May 8 deadline after which older signed versions would stop working. OpenAI said it found no evidence the signing certificate was actually exfiltrated.
The axios project committed to immutable releases, OIDC publishing, stronger GitHub Actions hygiene, and a release process less dependent on any one personal npm account.
Appendix · Affected releases
- The official postmortem says the malicious axios versions were live from 00:21 UTC to 03:15 UTC on March 31, 2026.
- Trend Micro maps SHA-1 2553649f2322049666871cea80a5d0d6adc700ca to axios 1.14.1 and d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 to axios 0.30.4. These are npm package checksums, not payload-file hashes.
- The postmortem timeline says plain-crypto-js 4.2.0 was first published on March 30, then 4.2.1 was injected into the malicious axios releases and removed at 03:29 UTC on March 31, 2026.
- Trend Micro identifies 07d889e2dadce6f3910dcbc253317d28ca61c766 as the SHA-1 of the malicious npm package. Its separate setup.js SHA-256 is retained above as a file indicator rather than an archive checksum.
References
- Five Supply Chain Attacks in Twelve Daysblog.dreamfactory.com
- Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotationsocket.dev
- Post Mortem: axios npm supply chain compromisegithub.com
- Axios npm package compromise indicators of compromise - Trend Microtrendmicro.com
- axios Compromised: npm Supply Chain Attack via Dependency Injectionsafedep.io
Source record: oss/attacks/axios/meta.yaml