--- title: Axios npm Package Compromised: Supply Chain Attack... description: Two malicious versions of the axios npm package (1.14.1 and 0.30.4) were published on March 31, 2026 via a compromised maintainer account. The packages... canonical: https://daily.dev/posts/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform-rat-fk3xmak18 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT | daily.dev og:description: Two malicious versions of the axios npm package (1.14.1 and 0.30.4) were published on March 31, 2026 via a compromised maintainer account. The packages... og:url: https://daily.dev/posts/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform-rat-fk3xmak18 og:image: https://api.daily.dev/og/posts/fK3XmAk18.png og:image:alt: Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT **[Snyk](https://daily.dev/sources/snyk)** · 9 min read · 1 upvotes · 0 comments ## Summary Two malicious versions of the axios npm package (1.14.1 and 0.30.4) were published on March 31, 2026 via a compromised maintainer account. The packages included a hidden dependency, plain-crypto-js@4.2.1, whose postinstall hook deployed a cross-platform remote access trojan (RAT) targeting macOS, Windows, and Linux. The dropper used double obfuscation and self-erasing techniques to avoid detection. The malicious versions were live for roughly three hours before removal. Anyone who ran npm install during that window should assume full system compromise, rotate all secrets, isolate affected machines, and rebuild environments. Mitigation advice includes using npm ci with committed lockfiles, enabling --ignore-scripts in CI, and auditing for indicators of compromise including outbound connections to sfrclak[.]com. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Top npm package backdoored to drop dirty RAT on dev machines](https://daily.dev/posts/top-npm-package-backdoored-to-drop-dirty-rat-on-dev-machines-cs5su7y7b) · The Register · 0 upvotes · 0 comments - [axios compromised on npm: maintainer account hijacked, RAT deployed](https://daily.dev/posts/axios-compromised-on-npm-maintainer-account-hijacked-rat-deployed-6mr1vfvvx) · Aikido Security · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm), [#axios](https://daily.dev/tags/axios) [View this post on daily.dev](https://daily.dev/posts/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform-rat-fk3xmak18) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT","url":"https://daily.dev/posts/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform-rat-fk3xmak18","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform-rat-fk3xmak18"},"datePublished":"2026-03-31T08:53:49.284Z","dateModified":"2026-03-31T08:55:05.390Z","description":"Two malicious versions of the axios npm package (1.14.1 and 0.30.4) were published on March 31, 2026 via a compromised maintainer account. The packages...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fae05c06309d27bf4d8f5e6f2e7e654?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fae05c06309d27bf4d8f5e6f2e7e654?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Snyk","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Snyk","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8fb2a7b471c04bac9af29fbeb3ed1cf6","url":"https://daily.dev/sources/snyk"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform-rat-fk3xmak18","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,malware,npm,axios","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Snyk","item":"https://daily.dev/sources/snyk"},{"@type":"ListItem","position":3,"name":"Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT"}]} ```