⚠️ Axios Supply Chain Attack — If You Installed Yesterday, Check This

yazar

Yesterday (March 31, 2026), one of the most widely used npm packages — axios — was compromised in a supply chain attack.

If you (or your CI) ran npm install during a short window, there’s a real chance your environment pulled malicious code.

No panic — but you should check.

🚨 What actually happened?

  • A maintainer account was compromised

  • Malicious versions of axios were published:

  • These versions pulled in a hidden dependency: plain-crypto-js

The scary part?

👉 The malware ran automatically via a postinstall script
👉 You didn’t even need to import axios
👉 It targeted macOS, Linux, and Windows

🎯 What it tried to steal:

  • ENV variables
  • Cloud credentials (AWS / GCP / Azure)
  • SSH keys
  • Tokens and secrets

🧪 How to check if you’re affected

If you installed dependencies between:

00:21 UTC – 03:20 UTC (March 31)

Check your lockfile — not just package.json.

Look for:

Quick check:

grep -E "axios" package-lock.json | grep -E "1.14.1|0.30.4"

If nothing shows up → you’re likely safe from this specific issue.

🛠️ What to do if you are affected

Treat the system as compromised. Don’t half-fix this.

1. Downgrade axios

"axios": "1.14.0"

2. Clean everything

rm -rf node_modules package-lock.json
npm cache clean --force
npm install

3. Rotate ALL secrets (seriously)

Assume everything is leaked:

  • API keys
  • DB credentials
  • AWS/GCP/Azure keys
  • GitHub tokens
  • npm tokens

4. Check for suspicious files

  • macOS → /Library/Caches/com.apple.act.mond
  • Linux → /tmp/ld.py

💡 Lessons for all of us

This wasn’t a “rare edge case”. This is the direction things are going.

A few takeaways:

🔒 1. Stop using loose versions in production

"axios": "^1.x.x" ❌
"axios": "1.14.0" ✅

🔍 2. Trust your lockfile more than package.json

Your real dependency tree lives there.

⚙️ 3. Add dependency scanning in CI/CD

Don’t rely on manual checks.

🧠 4. Assume breach mindset

Your dev machine and CI are not “safe by default”.

Final thought

The npm team removed the malicious versions quickly — but a few hours is enough to impact a lot of projects.

Supply chain security is no longer optional.

Stay sharp.