Delivered by Trust: What the Axios Supply Chain Attack…
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
On March 31, 2026, the widely used Axios NPM package was compromised after a maintainer account was taken over via social engineering, resulting in malicious versions 1.14.1 and 0.30.4 being published. These versions bundle a trojanized dependency that drops a stage-one loader during installation, connects to attacker infrastructure, and deploys OS-specific remote access trojans enabling persistent access, command execution, and data exfiltration. Organizations are urged to identify affected systems, roll back to safe versions (1.14.0, 0.30.3, or earlier), remove and reinstall node_modules, clear npm cache, rotate exposed credentials, hunt for indicators of compromise (including the plain-crypto-js package and C2 domains sfrclak.com and 142.11.206.73:8000), and adopt longer-term controls like dependency pinning, restricting install-time scripts, SBOMs, and limiting automated updates.
Table of contents
Serious RiskAttack Chain and Next StepsHigh PriorityNear-TermStrategicIn Supply Chains We Trust – Until We Can’tQuestions this post answers
Which versions of the axios npm package are compromised in the March 2026 supply chain attack?
Axios versions 1.14.1 and 0.30.4 were compromised after a trusted maintainer account was taken over through social engineering. These versions include a trojanized dependency that executes during installation and deploys platform-specific remote access trojans. Safe versions to roll back to are 1.14.0, 0.30.3, or earlier. daily.dev helps teams track dependency security incidents like the axios compromise before they hit production.
How does the malicious axios package deploy malware on infected systems?
The compromised package embeds a dependency that drops a stage-one loader (setup.js) during installation, which connects to attacker-controlled infrastructure to download and execute an OS-specific remote access trojan. The RAT then establishes remote access, executes commands, and maintains persistence. Indicators include the package plain-crypto-js and network traffic to sfrclak.com and 142.11.206.73:8000. Security engineers hunting for indicators of compromise can follow dependency threats on daily.dev.
What should organizations do to remediate a system infected by the axios supply chain attack?
Treat any affected system as fully compromised: identify use of the impacted axios versions, roll back to a safe version, remove node_modules and reinstall dependencies from a trusted state, clear the local npm cache, and rotate credentials exposed on affected systems such as API keys, tokens, and environment variables. Also review CI/CD logs for installation of impacted versions. Teams building supply chain response playbooks can stay ahead of incidents like this via daily.dev.