Repository navigation
axios@1.14.1 and axios@0.30.4 are compromised #10604
Description
more details: https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
Most likely, a maintainer's GitHub and npm accounts are compromised as these issues are getting deleted.
I have also reported this as a vulnerability, so that a CVE can be generated.
Activity
DigitalBrainJS commentedon Mar 31, 2026
Hmm, I doubt @jasonsaayman is here. He doesn't reply on Slack, but he managed to unpin and probably delete the recent issue.
AdnaneKhan commentedon Mar 31, 2026
@DigitalBrainJS can you try and trigger a clean minor version bump workflow?
AdnaneKhan commentedon Mar 31, 2026
@DigitalBrainJS if you bump to 1.14.2 in new tag it should publish via the OIDC trust
DigitalBrainJS commentedon Mar 31, 2026
It's pointless. Since access to git and the npm repository is compromised, and his git permissions are higher than mine. I'm a collaborator, not an admin. I can't revoke his access. Whatever I fix, he will "fix" it after me.
AdnaneKhan commentedon Mar 31, 2026
This issue has been live for a decent while now - GitHub may have suspended the account. It’s worth a shot to get mirrors and etc. to flush the bad release.
DigitalBrainJS commentedon Mar 31, 2026
At least we know that these are the @jasonsaayman credentials; that's why I pinned the issue to see on whose behalf the actions are being performed, when the issue was unpinned. So obviously, this is not an old account of one of the members of the Axios organization.
DigitalBrainJS commentedon Mar 31, 2026
I hope the npm administration will take action, but due to the late hour, I think there will be a delay. It's no coincidence that the attack was carried out at such a late hour. I've asked them to revoke all npm tokens. We'll deal with the git repository later.
Lunascaped commentedon Mar 31, 2026
I'm tired boss
Pierca7 commentedon Mar 31, 2026
The malware seems to have been taken down from npm https://www.npmjs.com/package/plain-crypto-js
DEV-DIBSTER commentedon Mar 31, 2026
It appears the affected axios version was taken down from Axios page on NpmJS.
amdcq commentedon Mar 31, 2026
On the positive side, something like this will hopefully be a wakeup call for more people and being taken more seriously.
LKNSI commentedon Mar 31, 2026
DEV-DIBSTER commentedon Mar 31, 2026
The only takeaways as of right now is you don't install package updates, especially new ones, blindly or automatically, and that supply chain risks exist.
Other then that, any speculations on how jasonsaayman npm and git credentials got compromised/used/exploited is up for grabs.
lukefr09 commentedon Mar 31, 2026
Worth noting for anyone doing triage, the payload renames a pre-staged clean package.md to package.json, overwriting the version with the postinstall hook, AND setup.js self-deletes.. so inspecting node_modules/plain-crypto-js/ post-install won't show any evidence of the compromise. If you're checking whether you were hit, lockfile diffing for plain-crypto-js is more reliable than inspecting node_modules directly. Network logs for outbound connections to sfrclak.com:8000 are your best bet also if lockfiles were regenerated. Good luck
353 remaining items
DigitalBrainJS commentedon Apr 1, 2026
I remember receiving several phishing emails over the last six months, purporting to be from GitHub, asking me to re-login for security reasons. But perhaps this has nothing to do with our hacker, and these emails are sent to everyone with a GitHub account. Besides, taking over a GitHub account doesn't explain how the hacker managed to change the email address in the NPM account, since the npm token from GitHub Secrets doesn't allow this. Session theft seems more likely, but then it turns out that the npm backend does not bind the session to the network and geolocation.
DanielRuf commentedon Apr 1, 2026
If they would directly do this in the background on the compromised account, it looks like they did it themself.
So even session binding often does not prevent some cases, especially social engineering like in this case.
9xN commentedon Apr 1, 2026
SpyC0der77 commentedon Apr 2, 2026
Axios got on trending because of this 😮
saadgheh commentedon Apr 2, 2026
tbroyer commentedon Apr 2, 2026
@saadgheh Your tool is attention-grabbing bullshit. You don't even know how dependencies are managed in JS projects.
https://github.com/saadgheh/SupplyGuard-AI/issues/1
gael-soude commentedon Apr 2, 2026
Just trying to make money with a AI generated script 🤦
HackingRepo commentedon Apr 2, 2026
npmjs i think need introduce oauth, npm login, will redirect you to login with your NPM account directly and after that you are logged in, OAUTH more secure and also afer inactivity, NPM require again to the user login for keep his account safe
bddjr commentedon Apr 2, 2026
I remember that now before manually running
npm publish, you do need to manually runnpm loginfirst; otherwise,npm publishwill return 404 Not Found.I'm not sure how long the session for
npm loginlasts.moara-ops commentedon Apr 2, 2026
Yes that's correct, before a manual npm publish, you need to run npm login first, otherwise npm publish can fail with 404 Not Found. Also, npm login is no longer long-lived: it now issues a session token that expires after 2 hours, so you may need to re-authenticate before publishing if the session has expired.
GitHub Changelog - NPM Classic Tokens
corneliusroemer commentedon Apr 2, 2026
This repo got 3000 spam issues in one day (March 23). Email bomb is a classic technique to bury security notifications. (See https://github.com/axios/axios/discussions/10612 for details)
Npm encourages linking your GitHub account for recovery purposes. Don't assume those phishing emails aren't related. North Korean state hackers here care very much about axios maintainers and not much about the average developer.
@jasonsaayman it would be great if you could review the audit logs on both GitHub and Npm to see when the first unauthorized activities happened. They should still be visible. I couldn't find in npm docs if there's an audit log but there really ought to be one.
jasonsaayman commentedon Apr 2, 2026
npm does not have logs like that readily available to my knowledge. also the "email bomb" does not affect me i dont get emails about issues from github explicity set to reduce noise very long ago.
as for github i have already. a postmortem is comming i am just getting it reviewed before releasing it. thanks for everyones comments etc.
saadgheh commentedon Apr 2, 2026
@tbroyer I appreciate the 'passionate' feedback. Open source thrives on scrutiny.
Regarding the JS ecosystem: I'm well aware of how transitive dependencies work (lock files, hoisted modules, etc.). v1.0 was a rapid 4-hour 'emergency manifest scanner' to catch the obvious. The community requested lock-file support, and that's exactly what's being pushed in v1.1 today.
Regarding AI: Tools (including AI) are there to accelerate response times during active breaches. Whether the script was born from a prompt or a keyboard doesn't matter—what matters is if it detects the malicious plain-crypto-js payload faster than a manual audit.
Regarding the PRO version: Security research takes time and infrastructure. Offering a paid tier for 'Auto-remediation' is a standard way to sustain independent security tools.
If you have a PR to improve the lock-file logic, I’m happy to review it. Otherwise, let’s focus on helping people secure their repos from the Axios RAT.
DanielRuf commentedon Apr 2, 2026
When it comes to finding malicious files, there are already trusted solutions. YARA and YARA rules.
Using the thread here to promote a (commercial) solution that was quickly created is very unprofessional.
jasonsaayman commentedon Apr 2, 2026
as promised here is post mortem link: https://github.com/axios/axios/issues/10636
i am locking this thread for now, comments are welcome on the postmortem