--- title: "Delivered by Trust: What the Axios Supply Chain Attack…" url: https://daily.dev/posts/delivered-by-trust-what-the-axios-supply-chain-attack--umbo45io5 source_url: https://bishopfox.com/blog/delivered-by-trust-what-the-axios-supply-chain-attack-means-for-security-leaders type: article source: "Sliver C2 Documentation" published: 2026-08-23T12:22:45.996Z updated: 2026-08-23T12:51:08.980Z tags: ["cyber", "malware", "npm", "axios"] reading_time: 4 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Delivered by Trust: What the Axios Supply Chain Attack… **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 4 min read · 0 upvotes · 0 comments ## Summary On March 31, 2026, the widely used Axios NPM package was compromised after a maintainer account was taken over via social engineering, resulting in malicious versions 1.14.1 and 0.30.4 being published. These versions bundle a trojanized dependency that drops a stage-one loader during installation, connects to attacker infrastructure, and deploys OS-specific remote access trojans enabling persistent access, command execution, and data exfiltration. Organizations are urged to identify affected systems, roll back to safe versions (1.14.0, 0.30.3, or earlier), remove and reinstall node_modules, clear npm cache, rotate exposed credentials, hunt for indicators of compromise (including the plain-crypto-js package and C2 domains sfrclak.com and 142.11.206.73:8000), and adopt longer-term controls like dependency pinning, restricting install-time scripts, SBOMs, and limiting automated updates. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Which versions of the axios npm package are compromised in the March 2026 supply chain attack? Axios versions 1.14.1 and 0.30.4 were compromised after a trusted maintainer account was taken over through social engineering. These versions include a trojanized dependency that executes during installation and deploys platform-specific remote access trojans. Safe versions to roll back to are 1.14.0, 0.30.3, or earlier. _daily.dev helps teams track dependency security incidents like the axios compromise before they hit production._ ### How does the malicious axios package deploy malware on infected systems? The compromised package embeds a dependency that drops a stage-one loader (setup.js) during installation, which connects to attacker-controlled infrastructure to download and execute an OS-specific remote access trojan. The RAT then establishes remote access, executes commands, and maintains persistence. Indicators include the package plain-crypto-js and network traffic to sfrclak.com and 142.11.206.73:8000. _Security engineers hunting for indicators of compromise can follow dependency threats on daily.dev._ ### What should organizations do to remediate a system infected by the axios supply chain attack? Treat any affected system as fully compromised: identify use of the impacted axios versions, roll back to a safe version, remove node_modules and reinstall dependencies from a trusted state, clear the local npm cache, and rotate credentials exposed on affected systems such as API keys, tokens, and environment variables. Also review CI/CD logs for installation of impacted versions. _Teams building supply chain response playbooks can stay ahead of incidents like this via daily.dev._ ## Similar posts on daily.dev - [Supply Chain Attack Impacts Widely Used Axios npm Package](https://daily.dev/posts/supply-chain-attack-impacts-widely-used-axios-npm-package-e3anajjqf) · Arctic Wolf · 0 upvotes · 0 comments - [Axios npm Package Compromised in Supply Chain Attack](https://daily.dev/posts/axios-npm-package-compromised-in-supply-chain-attack-yteqa7dzf) · InfoQ · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#npm](https://daily.dev/tags/npm), [#axios](https://daily.dev/tags/axios) [View this post on daily.dev](https://daily.dev/posts/delivered-by-trust-what-the-axios-supply-chain-attack--umbo45io5)