// threat brief

No CVE ID

axios npm package poisoned: maintainer account stolen, 1.14.1 and 0.30.4 shipped a remote access trojan

CVSS: —
CISA KEV: Not listed
Weakness: CWE-506
Topics: Supply chain

PlainCVE Team · Published 2026-09-23 · Updated 2026-09-24 · AI-assisted · Press brief ↓

Human review 2026-09-23Command tests: none yetReproduced: not yetVerification record ↓

Attackers hijacked an axios maintainer's npm account and published two versions with a malicious dependency; a plain npm install drops a remote access trojan.

Who is affected	Developer machines and CI environments that installed or updated to axios 1.14.1 or 0.30.4 between about 00:21 and 03:15 (UTC) on 2026-03-31, when the malicious axios versions were removed (the malicious dependency plain-crypto-js stayed up until 03:29). Projects with a version range of ^1.14.0 or ^0.30.0 and no lockfile were the most likely to be hit.
What happens	The attacker gains remote control of that computer and can run commands and read files, which means access to every key and credential on it.
What to do now	Check your lockfile and node_modules for plain-crypto-js. If it's there, treat the machine as compromised and rotate all credentials from a separate, clean machine. Upgrade axios to 1.15.0 or 0.31.0 or later. View evidence(4) Vendor / maintainerMaintainer post-mortem: rotate every secret, token and credential on an affected machineRotate every secret, token, and credential on that machinegithub.com Vulnerability databaseGitHub advisory: treat the machine as fully compromised and rotate all secrets and keys from a different, clean computer; removing the package does not remove what the attacker installedAll secrets and keys stored on that computer should be rotated immediately from a different computer.github.com CERT / governmentCISA recommends disabling install scripts by default (ignore-scripts), setting min-release-age, and phishing-resistant MFA on developer accountsSet ignore-scripts=true in the .npmrc configuration filecisa.gov ResearchersGoogle: if plain-crypto-js is found, assume the host is compromised, rotate credentials and block the published domain and IPIf plain-crypto-js is detected, assume the host environment is compromised.cloud.google.com
Affected versions	1.14.1, 0.30.4 (plus the malicious dependency plain-crypto-js 4.2.1) View evidence(4) Vendor / maintainerThe axios maintainer's post-mortem: the two malicious versions, 1.14.1 and 0.30.4, were published through the compromised accountOn March 31, 2026, two malicious versions of axios (1.14.1 and 0.30.4) were published to the npm registry through my compromised account.github.com Vendor / maintainerMaintainer post-mortem: both versions added the malicious dependency plain-crypto-js 4.2.1, which installs a remote access trojan on macOS, Windows and LinuxBoth versions injected a dependency called `plain-crypto-js@4.2.1` that installed a remote access trojan on macOS, Windows, and Linux.github.com Vendor / maintainerMaintainer post-mortem: projects already pinned to a clean version that did not reinstall between 00:21 and 03:15 UTC on March 31 are not affectedIf you were already pinned to a clean version and didn't run a fresh install between 00:21 and 03:15 UTC on March 31, you're fine.github.com Vulnerability databaseOSV (MAL-2026-2307): the affected axios versions are 0.30.4 and 1.14.1"versions":["0.30.4","1.14.1"]osv.dev
Fixed versions	The malicious versions have been removed; 1.15.0 or 0.31.0 or later is recommended (these also fix CVE-2026-40175) View evidence(4) Vendor / maintainerMaintainer post-mortem: the previous releases, 1.14.0 and 0.30.3, are clean versions without the malwareDowngrade to `axios@1.14.0` (or `0.30.3` for 0.x users)github.com ResearchersStepSecurity: both malicious versions were removed from npm and the latest tag reverted to 1.14.0Both versions are removed from the registry and the latest dist-tag reverts to 1.14.0.stepsecurity.io Our assessmentPlainCVE recommends 1.15.0 or 0.31.0 or later: 1.14.0 and 0.30.3 contain no malware but are still affected by CVE-2026-40175 CVE recordCVE-2026-40175 record: versions from 1.0.0 before 1.15.0 (and before 0.31.0) are affected by this separate flaw, which includes 1.14.0, the version recommended as a rollback during the incident"version":">= 1.0.0, < 1.15.0"cveawg.mitre.org
Timeline	Introduced 2026-03-31 · Malicious axios@1.14.1 published to npm source First public 2026-03-31 First attacks 2026-03-31 · Huntress sees first real infection, on a Mac source
CISA KEV	Not listed(Not being in KEV does not mean it has not been exploited) View evidence(4) Vendor / maintainerMaintainer post-mortem: the malicious versions were live on npm for about 3 hours before removalThe malicious versions were live for about 3 hours before being removed.github.com ResearchersStepSecurity's timeline: axios 1.14.1 was live on npm for just under 3 hours (about 00:21 to 03:15 UTC)axios@1.14.1 had been live for approximately 2 hours 53 minutesstepsecurity.io ResearchersHuntress observed the first real infection on 2026-03-31, on a MacFirst Huntress-observed infection — macOS endpoint executes RAThuntress.com Our assessmentThe incident has no CVE; it is tracked by GHSA and an OSV MAL ID, so it cannot appear in CISA KEV

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?

01Check lockfiles and node_modules
Look for axios 1.14.1, 0.30.4 or plain-crypto-js. The malware rewrites its version to 4.2.0, so check whether the folder exists.
Read-only check
```
grep -nE 'axios@(1\.14\.1|0\.30\.4)|plain-crypto-js' package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null
ls node_modules/plain-crypto-js 2>/dev/null && echo "plain-crypto-js found"
```
Step 3
02Check CI build logs
Review builds between about 00:21 and 03:29 UTC on 2026-03-31 (the malicious axios versions were removed around 03:15, plain-crypto-js at 03:29) for npm installs that resolved those versions.
Step 3

MITIGATEFix / mitigatePatch; block it if you cannot patch yet

01Upgrade axios to 1.15.0 or 0.31.0 or later
This also fixes CVE-2026-40175.
02Block the published malicious domains and IPs
Block and search logs for the domains and IPs published by CISA and Google.
Step 4 Step 5

RESPONDRespondIf you find signs of compromise

01Treat the affected machine as fully compromised
Removing the package does not remove what the attacker installed; isolate and investigate affected hosts.
Step 5
02Rotate every credential from a clean machine
Version-control tokens, CI/CD secrets, cloud keys, npm tokens, SSH keys.
Step 5
03Remove the malicious package and caches
Delete node_modules/plain-crypto-js/, run npm cache clean --force, and clear internal package caches too.
Step 3

HARDENHardenPrevent the next one

01Don't run install scripts by default
Set ignore-scripts=true in .npmrc, or use npm ci --ignore-scripts in CI.
Step 3
02Delay new releases and pin versions
Set min-release-age=7 and commit your lockfile so dependencies never change without you knowing.
Step 2 Step 3
03Use phishing-resistant MFA on developer accounts
Step 1
04Maintainers: publish with OIDC Trusted Publishing
Disable long-lived tokens that can publish manually.
Step 2

Full remediation steps and notes

First, check whether you were hit. Run the commands above on every project, every developer machine, and CI.
If you were hit:
- Treat that machine as fully compromised. The GitHub advisory specifically warns that removing the package doesn’t remove whatever the attacker installed, and that credentials should be rotated from a separate, clean machine.
- Rotate every credential on that machine and in those pipelines: version control tokens, CI/CD secrets, cloud keys, npm tokens, SSH keys.
- Delete node_modules/plain-crypto-js/, run npm cache clean --force, and clear your company’s internal package caches as well.
- Block the domains and IPs published by CISA and Google and search your logs for them; isolate and investigate affected hosts.
Upgrade axios. During the incident, the maintainers and CISA advised rolling back to 1.14.0 (or 0.30.3). Those versions contain no malware but are still affected by a separate flaw, CVE-2026-40175, so we recommend going straight to 1.15.0 or 0.31.0 or later.
Long-term hardening. ignore-scripts, min-release-age, pinned version numbers, and phishing-resistant MFA on developer accounts; package maintainers should switch to OIDC Trusted Publishing.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.

Attacker
Breaks into the maintainer's personal computer through social engineering
The maintainer's post-mortem says this was a targeted social engineering attack, and the malware gave the attacker their npm credentials.
Defense: Use phishing-resistant MFA (such as security keys) on developer accounts.
Attacker
Manually publishes 1.14.1 and 0.30.4 with the stolen token
npm records show the previous 1.x release, 1.14.0, was published through GitHub Actions and OIDC (the 0.x line's 0.30.3 was published from a maintainer account). These two versions have no matching GitHub commit or tag; they were uploaded directly with the stolen token.
Defense: Allow only OIDC Trusted Publishing and disable long-lived tokens that can publish manually.
Your system
A developer or CI runs npm install
The new versions add a dependency, plain-crypto-js, that axios never actually uses, and its install script (postinstall) runs automatically.
Defense: npm ci --ignore-scripts; set min-release-age to delay adopting new versions; pin versions with a lockfile.
External
The install script downloads a remote access trojan for the victim's operating system
It supports Windows, macOS, and Linux. Afterwards it deletes itself and swaps the package manifest for a clean-looking version.
Defense: Restrict outbound connections from developer machines and CI; block the malicious domains and IPs published by the authorities and vendors.
Attacker
Remotely controls the victim's computer
It can run commands, list files, and check in regularly, and on Windows it also sets itself up to run at startup.

Who is affected

Condition	Affected?
Installed axios 1.14.1 or 0.30.4 between about 00:21 and 03:15 UTC on 2026-03-31 (before the malicious versions were removed)	Affected; treat that machine as compromised
Lockfile pinned to a different version, and dependencies were not re-resolved during that window	Not affected
Installed with `npm ci --ignore-scripts`	The malicious install script does not run
axios 1.14.0, 0.30.3	No malware, but still affected by CVE-2026-40175; upgrading is recommended

How to check:

# Does the lockfile contain a malicious version or the malicious dependency?
grep -nE 'axios@(1\.14\.1|0\.30\.4)|plain-crypto-js' package-lock.json yarn.lock pnpm-lock.yaml 2>/dev/null
# Is this folder in node_modules? (The version number may have been faked as 4.2.0, so just check whether the folder exists)
ls node_modules/plain-crypto-js 2>/dev/null && echo "Found plain-crypto-js; follow the steps under How to fix"

Check your CI environments too: go through the build logs from that window and see whether any npm install resolved to the versions above.

How it works

This isn’t a vulnerability in axios’s code. It’s the publishing channel being taken over.

The account was stolen. The maintainer’s personal computer was compromised through social engineering, leaking their npm credentials; Google’s report notes that the account’s email was also changed to an address the attacker controlled.
The normal release process was bypassed. npm’s version records show that the previous 1.x release, 1.14.0, was published by GitHub Actions through OIDC (Trusted Publishing) with a provenance attestation. The 0.x line was different: the previous release, 0.30.3, was published directly from a maintainer account without those fields. These two malicious versions were uploaded manually with the stolen token and have no matching commit or tag.
It was hidden in a dependency. axios’s own code was barely touched; the only change was a new dependency, plain-crypto-js, in package.json. axios never uses it, but npm automatically runs its postinstall script during installation.
It covered its tracks. After downloading the trojan, the script deleted itself and swapped the package manifest for a clean-looking version 4.2.0. So when you check, look at whether the folder exists, not just the version number.

The risky setup:

Show code example(json)

{ "dependencies": { "axios": "^1.14.0" } }

Without a lockfile, ^1.14.0 would automatically install whatever was newest at the time, which was 1.14.1.

A safer setup:

Show code example(ini)

# .npmrc
ignore-scripts=true      # don't run package install scripts by default
min-release-age=7        # don't automatically adopt versions published less than 7 days ago

Combine this with committing your lockfile and using npm ci in CI, and your dependency versions won’t change without you knowing.

Timeline

Time (UTC)	Event
2026-03-30 05:57	Decoy package plain-crypto-js 4.2.0 (harmless) published
2026-03-30 23:59	Malicious plain-crypto-js 4.2.1 published
2026-03-31 00:21	axios 1.14.1 published
2026-03-31 01:00	axios 0.30.4 published; outside researchers start detecting anomalies
2026-03-31 01:38	axios collaborators begin responding and contact npm
2026-03-31 about 03:15	Both malicious versions removed; GitHub security advisory published
2026-03-31 03:29	plain-crypto-js removed
2026-04-01	Google and Microsoft publish their investigations and attributions
2026-04-20	CISA issues an alert

Verification Reviewed and checked against sources; not yet reproduced in our lab

Reviewed	2026-09-23

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

CVE / NVD / OSVCVE-2026-40175 Record (CVE Services API) · CVE Program, 2026-04-10 · accessed 2026-09-24
A separate axios vulnerability (unrelated to this poisoning), affecting versions from 1.0.0 before 1.15.0 and before 0.31.0.
OtherHuntress sees first real infection, on a Mac · www.huntress.com · accessed 2026-09-24
AdvisoryPost-mortem: axios@1.14.1 and axios@0.30.4 compromise (issue #10636) · axios maintainers (GitHub), 2026-03-31 · accessed 2026-09-24
AdvisoryGHSA-fw8c-xr5c-95f9 — Malware in axios · GitHub Advisory Database, 2026-03-31 · accessed 2026-09-23
CVE / NVD / OSVMAL-2026-2307 · OSV / OpenSSF Malicious Packages, 2026-03-31 · accessed 2026-09-23
AdvisorySupply Chain Compromise Impacts Axios Node Package Manager · CISA, 2026-04-20 · accessed 2026-09-23
ResearchNorth Korea threat actor targets axios npm package · Google Threat Intelligence Group, 2026-04-01 · accessed 2026-09-23
ResearchMitigating the axios npm supply chain compromise · Microsoft Security Blog, 2026-04-01 · accessed 2026-09-23
Otheraxios 1.14.0 version metadata (npm registry) · npm registry · accessed 2026-09-24
Otheraxios 0.30.3 version metadata (npm registry) · npm registry · accessed 2026-09-24
Researchaxios compromised on npm — malicious versions drop remote access trojan · StepSecurity · accessed 2026-09-23

Press brief

In one sentence

On March 31, 2026, two versions of axios, a JavaScript package with extremely high weekly downloads, were laced with malware and stayed available online for about three hours. The attackers first broke into a maintainer's computer and hijacked the publishing account. Both Google and Microsoft attributed the incident to groups linked to North Korea. The incident has no CVE number; it is tracked as GHSA-fw8c-xr5c-95f9.

Key facts

Malicious versions: axios 1.14.1 and 0.30.4 github.com
Time online: About 3 hours (2026-03-31 00:21 to about 03:15 UTC; the malicious dependency was removed at 03:29) github.com
Tracking ID: GHSA-fw8c-xr5c-95f9 (no CVE) github.com
Google attribution: UNC1069 (linked to North Korea) cloud.google.com
Microsoft attribution: Sapphire Sleet (linked to North Korea) microsoft.com
CISA alert: 2026-04-20 cisa.gov

Confirmed

The attackers used stolen npm credentials to publish the two versions by hand; neither has a matching GitHub commit or tag.
The malware was hidden in a newly added dependency, plain-crypto-js, which runs automatically on install and targets Windows, macOS and Linux.
Both malicious versions were taken down within about three hours.

Unconfirmed / disputed

How many projects were affected and how many times the versions were downloaded: public figures come from secondary sources, so this page does not cite them.
Whether the groups named by Google and Microsoft are the same group.

Quotable line

The attackers didn't change a single line of axios's actual functionality. They just added one dependency, and npm install ran it for you.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

axios npm package poisoned: maintainer account stolen, 1.14.1 and 0.30.4 shipped a remote access trojan

On March 31, 2026, two versions of axios, a JavaScript package with extremely high weekly downloads, were laced with malware and stayed available online for about three hours. The attackers first broke into a maintainer's computer and hijacked the publishing account. Both Google and Microsoft attributed the incident to groups linked to North Korea. The incident has no CVE number; it is tracked as GHSA-fw8c-xr5c-95f9.

Key facts:
- Malicious versions:axios 1.14.1 and 0.30.4(https://github.com/advisories/GHSA-fw8c-xr5c-95f9)
- Time online:About 3 hours (2026-03-31 00:21 to about 03:15 UTC; the malicious dependency was removed at 03:29)(https://github.com/axios/axios/issues/10636)
- Tracking ID:GHSA-fw8c-xr5c-95f9 (no CVE)(https://github.com/advisories/GHSA-fw8c-xr5c-95f9)
- Google attribution:UNC1069 (linked to North Korea)(https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package)
- Microsoft attribution:Sapphire Sleet (linked to North Korea)(https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/)
- CISA alert:2026-04-20(https://www.cisa.gov/news-events/alerts/2026/04/20/supply-chain-compromise-impacts-axios-node-package-manager)

Confirmed:
- The attackers used stolen npm credentials to publish the two versions by hand; neither has a matching GitHub commit or tag.
- The malware was hidden in a newly added dependency, plain-crypto-js, which runs automatically on install and targets Windows, macOS and Linux.
- Both malicious versions were taken down within about three hours.

Unconfirmed / disputed:
- How many projects were affected and how many times the versions were downloaded: public figures come from secondary sources, so this page does not cite them.
- Whether the groups named by Google and Microsoft are the same group.

「The attackers didn't change a single line of axios's actual functionality. They just added one dependency, and npm install ran it for you.」— PlainCVE
https://plaincve.date/en/vulns/ghsa-2026-axios-npm-compromise

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "axios npm package poisoned: maintainer account stolen, 1.14.1 and 0.30.4 shipped a remote access trojan". PlainCVE. https://plaincve.date/en/vulns/ghsa-2026-axios-npm-compromise (accessed YYYY-MM-DD)

BibTeX

@misc{ghsa2026axiosnpmcompromise2026,
  title  = {axios npm package poisoned: maintainer account stolen, 1.14.1 and 0.30.4 shipped a remote access trojan},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/ghsa-2026-axios-npm-compromise},
  note   = {Updated 2026-09-24}
}