--- title: axios_compromise.md | daily.dev description: The npm maintainer account for the widely-used axios HTTP client was compromised, resulting in two malicious versions (1.14.1 and 0.30.4) being published and... canonical: https://daily.dev/posts/axios-compromise-md-kgpz2fi6i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: axios_compromise.md | daily.dev og:description: The npm maintainer account for the widely-used axios HTTP client was compromised, resulting in two malicious versions (1.14.1 and 0.30.4) being published and... og:url: https://daily.dev/posts/axios-compromise-md-kgpz2fi6i og:image: https://api.daily.dev/og/posts/KGpz2Fi6I.png og:image:alt: axios_compromise.md og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # axios_compromise.md **[Reid Burke](https://daily.dev/sources/reidburke)** · 5 min read · 0 upvotes · 0 comments ## Summary The npm maintainer account for the widely-used axios HTTP client was compromised, resulting in two malicious versions (1.14.1 and 0.30.4) being published and tagged as 'latest' and 'legacy'. The attacker introduced a typosquat dependency 'plain-crypto-js' containing an obfuscated postinstall script that downloads and executes platform-specific stage-2 payloads from a C2 server (sfrclak.com) on macOS, Windows, and Linux. The payload self-deletes and overwrites package.json to evade forensic detection. Any system running npm install after 2026-03-31T00:21:58Z without a lockfile pinning a prior safe version may be compromised. Immediate actions include checking lockfiles for the malicious versions, pinning axios to 1.14.0 or earlier, hunting for listed IOCs, rotating credentials, and blocking the C2 domain. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [axios compromised on npm: maintainer account hijacked, RAT deployed](https://daily.dev/posts/axios-compromised-on-npm-maintainer-account-hijacked-rat-deployed-6mr1vfvvx) · Aikido Security · 0 upvotes · 0 comments - [Axios npm Package Compromised With Remote Access Trojan](https://daily.dev/posts/axios-npm-package-compromised-with-remote-access-trojan-0uj2ass08) · Laravel News · 4 upvotes · 0 comments - [Post Mortem: axios npm supply chain compromise · Issue \#10636 · axios](https://daily.dev/posts/post-mortem-axios-npm-supply-chain-compromise-issue-10636-axios-fi8w1s47t) · Hacker News · 0 upvotes · 0 comments - [Axios npm Package Compromised in Supply Chain Attack](https://daily.dev/posts/axios-npm-package-compromised-in-supply-chain-attack-yteqa7dzf) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm), [#axios](https://daily.dev/tags/axios) [View this post on daily.dev](https://daily.dev/posts/axios-compromise-md-kgpz2fi6i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"axios_compromise.md","url":"https://daily.dev/posts/axios-compromise-md-kgpz2fi6i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/axios-compromise-md-kgpz2fi6i"},"datePublished":"2026-03-31T07:14:46.977Z","dateModified":"2026-03-31T07:16:39.320Z","description":"The npm maintainer account for the widely-used axios HTTP client was compromised, resulting in two malicious versions (1.14.1 and 0.30.4) being published and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e1243c1243ed74cc7f9615599f65ad74?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e1243c1243ed74cc7f9615599f65ad74?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Reid Burke","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Reid Burke","logo":"https://media.daily.dev/image/upload/s--dGMoFloX--/f_auto/v1761722479/logos/reidburke","url":"https://daily.dev/sources/reidburke"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/axios-compromise-md-kgpz2fi6i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,malware,npm,axios","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Reid Burke","item":"https://daily.dev/sources/reidburke"},{"@type":"ListItem","position":3,"name":"axios_compromise.md"}]} ```