The Axios Hack: How a single compromised account put millions of developers at risk

If you’ve ever built a website, run a startup, or shipped software of any kind in the last decade, there’s a good chance you’ve used axios. It’s one of those software tools that powers enormous chunks of the internet. It is a JavaScript library that handles the basic but essential task of fetching data from servers. Millions of developers and automated systems download it every single week.

This week, hackers tried to burn it down in one of the most operationally sophisticated supply chain attacks ever executed against an npm package. Axios is an npm package — an npm (Node Package Manager) is like an App Store for code and developers use it download pre-build software tools.

According to a report by cybersecurity startup StepSecurity, a threat actor managed to compromise axios and, through it, potentially create a backdoor into the machines of any developer unlucky enough to run a routine package install at the wrong moment.

A stolen password

The attack began with a stolen password. The attacker hijacked the npm account credentials of a lead axios maintainer — someone who pushes updates to the software — and then quickly changed the account’s associated email to an anonymous ProtonMail address. This effectively locked the real owner out before they could respond.

With those keys in hand, the attacker didn’t rush. In fact 18 hours before publishing anything, the hacker quietly uploaded a malicious package to npm called ‘plain-crypto-js’ and left it sitting there. This pre-staging phase is what separates an opportunistic hack from a calculated operation — the attacker had already built separate payloads for macOS, Windows, and Linux, ensuring no developer on any platform would be spared.

Then came the execution. Two poisoned versions of axios were published — ‘axios@1.14.1’ and ‘axios@0.30.4’ — hitting both major release branches that developers actively use. Both were live within 39 minutes of each other, StepSecurity’s report observed.

If a developer or an automated system had downloaded either version and opened the code, they would have found nothing obviously wrong. The axios code itself was clean. There was no malware hiding in its functions, no suspicious scripts buried in the library. A developer doing a quick spot-check would have walked away satisfied.

A level deeper

The real hack was one level deeper as the attackers quietly listed ‘plain-crypto-js’ — that package staged 18 hours earlier — as a dependency. When npm installs a package, it automatically installs all of its dependencies too.

So while developers thought they were just updating a trusted tool, they were also silently pulling down a Remote Access Trojan (RAT) — a malware that opens a persistent backdoor into the infected machine and hands a remote attacker full access to its contents.

To make things worse, the malware was built to self-destruct after execution, deleting traces of itself, making it difficult to carry out forensic analysis. And the attack bypassed the normal release process entirely — there is no 1.14.1 tag anywhere on the axios GitHub repository, per the cybersecurity firm’s report. It was published directly to npm, skipping the automated testing pipelines and code review processes that are supposed to catch exactly this kind of thing.

End user impact

End users of websites and apps don’t install npm packages, but they use software built by developers who do. If a developer’s machine is compromised through an attack like this, anything that developer can access becomes a potential target, which includes production databases and user data. The blast radius of a single compromised developer account at the right company could be enormous. Users can’t patch this themselves, so companies who use such software must implement better safeguards around package publishing.

What makes this attack so unsettling is that all the hackers had to do was just steal the password of one of the axios maintainers. That gave them access to install two malware that were downloaded as trusted packages by millions of unsuspecting developers. The open-source ecosystem runs on trust and convenience, and those two have turned into the system’s greatest weakness.

As long as a single compromised account can silently publish to a package downloaded more than a billion times a month, we are all, in some sense, one phishing email away from catastrophe.​​​​​​​​​​​​​​​​

What should you need to do right now?

If you installed either ‘axios@1.14.1’ or ‘axios@0.30.4,’ the recommended next step is to assume the worst and treat your machines as fully compromised. That means immediately rotating every secret that machine has ever touched — API keys, SSH keys, database passwords, environment variables, OAuth tokens, all of it. Credentials that have been exposed need to be traced across every system they grant access to.

Developers should roll back to ‘axios@1.14.0’ or ‘axios@0.30.3,’ — both of which are clean, per StepSecurity report. Checking network logs for suspicious outbound connections — particularly anything reaching unfamiliar external servers — is also essential, since a RAT communicates back to an attacker’s command-and-control server over the network.

Published – April 02, 2026 01:29 pm IST