Axios NPM Supply Chain Compromise: Malicious Packages Deliver . . . A single compromised maintainer account turned one of the most trusted packages in the npm ecosystem into an attack vector The attacker pre-staged the malicious dependency 18 hours before publishing the poisoned Axios versions, demonstrating operational planning designed to evade detection
Axios NPM Package Breached in North Korean Supply Chain . . . Compromised account and attack timeline The supply chain attack was highly targeted and premeditated, security researchers say To mount the attack, the threat actors compromised the NPM account of @jasonsaayman, the primary maintainer of Axios, Huntress explains
Axios NPM Package Compromised: Supply Chain Attack Hits . . . Axios, a widely used JavaScript HTTP client with over 100 million weekly npm downloads, was compromised when an attacker hijacked the lead maintainer’s npm account and published two malicious versions (1 14 1 and 0 30 4) that deployed a cross-platform remote access trojan (RAT)
axios Compromised on npm - Malicious Versions Drop Remote . . . This is among the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package These compromises were detected by StepSecurity AI Package Analyst [1] [2] and StepSecurity Harden-Runner We have responsibly disclosed the issue to the project maintainers
Mitigating the Axios npm supply chain compromise Mitigating . . . On March 31, 2026, the popular HTTP client Axios experienced a supply chain attack, causing two newly published npm packages for version updates to download from command and control (C2) that Microsoft Threat Intelligence has attributed to the North Korean state actor Sapphire Sleet Although the malicious versions are no longer available for download, since Axios is one of the most widely
axios Was Compromised on npm — What Happened, How It Works . . . This article walks you through exactly what happened, how the attack technically works, how to check if you're compromised, and what permanent changes you should make to your workflow The operation was pre-staged 18 hours in advance This was not opportunistic Every artifact was purpose-built
UNC1069 Social Engineering of Axios Maintainer Led to npm . . . The maintainer of the Axios npm package has confirmed that the supply chain compromise was the result of a highly-targeted social engineering campaign orchestrated by North Korean threat actors tracked as UNC1069