Skip to content
Surge in Supply Chain Attacks: Axios Compromised

Surge in Supply Chain Attacks: Axios Compromised

First seen 22 Oct 2026, 05:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 07:09 UTC
  • •Axios package was compromised, leading to malicious updates being published.
  • •19,500 malicious packages were confirmed from a total of 7.5 million analyzed.
  • •Supply chain attacks now account for 25% of significant security incidents.

In 2026, supply chain attacks surged, with notable incidents involving the axios package. Aikido Intel reported 19,500 malicious packages identified from 7.5 million analyzed, with attackers exploiting open source dependencies. In March 2026, attackers compromised the npm account of an axios maintainer, publishing two malicious versions (v1.14.1 and v0.30.4) that introduced a dependency on a malicious package, plain-crypto-js. Although these versions were removed within hours, the rapid adoption of axios in development environments led to significant exposure, with execution observed in 3% of affected environments. The increase in supply chain attacks from 10% of significant incidents in H2 2025 to 25% in H1 2026 highlights the urgency for enhanced security measures.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-03-30
Malicious axios version published
An attacker published a clean decoy package before swapping it with a malicious version, leading to widespread exposure.
Aikido.Dev
2025-03-31
Malicious axios versions removed
npm removed the compromised axios versions within three hours of their publication after detection.
Wiz
2026-10-19
Wiz report published
Wiz highlighted the increasing trend of supply chain attacks and the challenges they pose to security teams.
Wiz
2026-10-21
Aikido Intel report published
Aikido Intel released findings on supply chain security, detailing the surge in malicious packages and best practices.
Aikido.Dev

More articles in this cluster (2)

Following this threat?

Track CanisterWorm and Ethereum in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 3

Common questions

What packages were affected by the axios compromise?
The axios package versions v1.14.1 and v0.30.4 were compromised, introducing a dependency on a malicious package.
How quickly were the malicious axios versions removed?
The malicious versions were removed by npm within three hours of their publication after detection.
What is the current trend in supply chain attacks?
Supply chain attacks accounted for 25% of significant security incidents in H1 2026, up from 10% in H2 2025.