# The AxiosSupply Chain Attack— What Happened and How to Prevent It

100 million weekly downloads compromised overnight. The .npmrc config, lockfile discipline, and update strategy that would have protected you.

Nicolas•Founder & CEO

•March 31, 2026•12 min read

## What You Need to Know

March 31, 2026

- **The attack:** An attacker hijacked the npm account of axios's lead maintainer and published two backdoored versions (1.14.1 and 0.30.4) that install a cross-platform remote access trojan via a hidden dependency.

- **The impact:** Axios is downloaded ~100 million times per week. Both the `latest` and `legacy` tags were poisoned, meaning any `npm install axios` pulled the malware.

- **The fix:** Downgrade to axios@1.14.0 or 0.30.3, delete `node_modules/plain-crypto-js`, rotate every secret on affected machines, and harden your `.npmrc`.

## What Happened

On March 30, 2026, an attacker compromised the npm account of **jasonsaayman** — the lead maintainer of the axios project — and changed the registered email to an attacker-controlled Proton Mail address. Within hours, they published two backdoored versions that injected a phantom dependency called `plain-crypto-js@4.2.1`. StepSecurity's research team was [first to identify and report](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan) the compromise.

This dependency is never imported anywhere in the axios source code. Its sole purpose is to execute a `postinstall` script that acts as a cross-platform RAT dropper. The payload targets macOS, Windows, and Linux with separate binaries — each pre-built and staged 18 hours before the attack went live. Socket's [deep-dive analysis](https://socket.dev/blog/axios-npm-package-compromised) found additional packages distributing the same malware through vendored dependencies.

The dropper uses two layers of obfuscation — reversed Base64 encoding with padding character substitution and XOR cipher with the key `OrDeR_7077`. After execution, the malware deletes itself and replaces its own `package.json` with a clean version to evade forensic detection. Every trace was designed to self-destruct. Snyk has a [detailed technical breakdown](https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/) of the full payload chain.

### Attack Timeline

| Date & Time        | Event                                                            |
|---------------------|------------------------------------------------------------------|
| Mar 30, 05:57 UTC   | Clean plain-crypto-js@4.2.0 published to npm (staging)          |
| Mar 30, 23:59 UTC   | Malicious plain-crypto-js@4.2.1 published with RAT payload      |
| Mar 31, 00:21 UTC   | axios@1.14.1 published with plain-crypto-js injected (tagged latest) |
| Mar 31, 01:00 UTC   | axios@0.30.4 published (tagged legacy) — both branches poisoned |
| Mar 31, ~03:00 UTC  | npm removes malicious versions after community reports           |

## Why It's Worse Than You Think

Most teams I talk to had the same initial reaction: “We don't use axios.” And they're wrong. Axios is a _transitive_ dependency for thousands of packages. As [The Hacker News reported](https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html), this is “potentially one of the largest in npm history” by blast radius. Your project might not list it in `package.json`, but there's a good chance something in your `node_modules` depends on it.

Run `npm ls axios` in any non-trivial Node.js project. You'll likely see it appear multiple times through packages you never associated with HTTP clients.

### Popular packages that depend on axios

- `@slack/web-api`
- `@nestjs/axios`
- `twilio`
- `@sendgrid/client`
- `contentful`
- `plaid`

The real lesson

Any package with `