The Worst Hack of 2026: How the Axios NPM Supply Chain Attack Compromised Millions

Unpacking the Disastrous Axios NPM Supply Chain Malware Attack

The foundational HTTP library Axios, which boasts over 100 million weekly npm downloads, recently suffered a highly sophisticated supply chain attack after a lead maintainer’s account was compromised. By cleverly injecting a transient malicious dependency, hackers deployed an untraceable remote access Trojan (RAT) across vulnerable systems in mere seconds. This monumental breach highlights the critical, systemic vulnerabilities inherent in open-source software ecosystems and necessitates an immediate reevaluation of automated CI/CD security protocols.

Points clés

Axios, a strictly ubiquitous HTTP library with over 100 million weekly downloads, was compromised via a supply chain attack.
The attack originated when the long-lived npm classic access token of Jason Semen, a lead maintainer for Axios, was stolen by malicious actors.
Hackers avoided injecting malicious code directly into Axios’s source files; instead, they modified the package.json file to include a seemingly innocent crypto.js dependency.
The attackers successfully bypassed standard CI/CD pipeline guardrails by exploiting the npm CLI to stage a clean file 18 hours before deploying the malicious payload.
Cybersecurity firm Socket.dev was the first to discover the breach, identifying that the 1.14.1 and 0.30.4 release branches were poisoned within 39 minutes of each other.
Unsuspecting users triggered the attack upon running an npm install, which executed an automatic postinstall script activating a dropper named setup.js.
The setup.js payload utilized two layers of obfuscation (XR and Base64) to hide its illicit commands from static security scanners.
In under 1.1 seconds, the script detected the victim’s operating system (Mac, Windows, or Linux) and downloaded an OS-specific remote access Trojan (RAT) from a command and control (C2) server.
The malware immediately deleted its tracks by erasing setup.js and the malicious package.json, reinstating a clean version to leave zero trace of the infiltration.
Security researchers, including John Hammond, urge developers to audit their systems using commands like npm list -g axios and immediately rotate all API keys and credentials if compromised versions are found.

À retenir

So, what should you, a perfectly harmless computer user, do about invisible cyber-ninjas lurking in your software updates? First, treat open-source code like free gas station sushi—undeniably convenient, but potentially catastrophic for your system. If you suspect your machine accidentally swallowed the compromised Axios update, do more than just delete a file or two. React like a reasonable adult: assume your computer is fully possessed, nuke your credentials from orbit, rotate every password you own, and perhaps consider a serene, completely offline life as a 19th-century blacksmith. At least anvils don’t download remote access Trojans in 1.1 seconds.

Sources