axios compromised on npm: maintainer account hijacked, RAT deployed

Credit to Socket ( ) and StepSecurity ( ) for great analysis.

How to check if you are affected by the axios attack

Connect your repositories to Aikido ( ). Aikido's Malware Monitor compares your dependencies against Aikido Intel's live malware feed. If a [email protected] , [email protected] , or [email protected] is present in any of your projects, Aikido flags it immediately. This works on the free tier.

The attacker compromised the jasonsaayman npm account, the primary maintainer of axios. The account email was changed to ifstap@proton.me . The attacker then published [email protected] at 00:21 UTC on March 31 and [email protected] at 01:00 UTC. Both the 1.x and legacy 0.x branches were hit within 39 minutes.

Neither version had a corresponding commit, tag, or release in the axios GitHub repository. Legitimate axios releases are published via GitHub Actions with OIDC Trusted Publisher binding. These were published manually with a stolen npm access token.

The only change in both versions was the addition of plain-crypto-js@^4.2.1 as a dependency. This package is never imported anywhere in the axios source. It exists solely to run a postinstall hook that deploys a RAT.

The dependency was pre-staged ~18 hours earlier by a separate attacker account (nrwise, nrwise@proton.me ). A clean decoy version (4.2.0) was published first to build registry history, followed by the malicious 4.2.1 at 23:59 UTC on March 30.

The RAT dropper (setup.js) contacts sfrclak[.]com:8000 and delivers platform-specific payloads: a macOS binary disguised as an Apple cache daemon at /Library/Caches/com.apple.act.mond, a PowerShell script on Windows run via hidden VBScript with the interpreter copied to %PROGRAMDATA%\wt.exe, and a Python script on Linux at /tmp/ld.py. After execution, the dropper deletes itself and replaces its own package.json with a clean stub to hide evidence.

Indicators of compromise (IOCs)

Malicious axios versions and dependencies:

Aikido Safe Chain ( ) is an open-source tool that wraps around npm, yarn, and pnpm. It checks every package against Aikido Intel's malware feed before it reaches your machine and enforces a configurable minimum package age (48 hours by default), suppressing newly published versions until they have been validated. In this axios attack, [email protected] existed for less than 24 hours before the compromised axios versions pulled it in. Safe Chain's age check alone would have blocked it.

Free, no tokens required:

Developing story... Stay tuned for updates.

Secure your code, cloud, and runtime in one central system. Find and fix vulnerabilities fast automatically.