axios Compromised on npm - Malicious Versions Drop Remote Access Trojan

TL;DR: A hijacked maintainer account published two tampered axios versions, 1.14.1 and 0.30.4, on March 31, 2026. Both pulled plain-crypto-js@4.2.1, whose postinstall script dropped a cross-platform remote access trojan (RAT) beaconing to sfrclak.com (142.11.206.73) every 60 seconds. The malicious versions were live on npm for ~3 hours. Safe versions are 1.14.0 and 0.30.3. Treat any host that ran npm install during the attack window as compromised.

Table of contents

• Quick answer
• When this matters
• What you will learn
• How the axios compromise worked
• Indicators of compromise
• Detection and triage checklist
• Containment and recovery steps
• npm 14-day freshness policy
• Hardening your CI pipeline
• Cost of inaction
• Is axios safe to use after this incident
• How do I know if my CI runners were hit
• Do I need to rotate all secrets
• Should we block axios entirely
• What should we do next
• Get your free security assessment
• Next steps
• References
• Definitions
• Common mistakes
• FAQ

Quick answer

axios was not backdoored at source. A hijacked maintainer account published two tampered versions, 1.14.1 and 0.30.4, on March 31, 2026. Both versions added a dependency on plain-crypto-js@4.2.1, which ran a postinstall script that dropped a cross-platform remote access trojan (RAT). The RAT beaconed to sfrclak.com (142.11.206.73) every 60 seconds, accepting attacker commands and exfiltrating host-accessible secrets. The malicious versions were live on npm for ~3 hours before removal. Safe versions are 1.14.0 and 0.30.3. If you installed axios during the attack window, treat every host that ran npm install as compromised. To pressure-test your response path before the next build, book a free security assessment and baseline your posture with a security scorecard. If active C2 is already confirmed, route through help, I’ve been hacked.

When this matters

This matters if any developer workstation, CI runner, build server, or container image ran npm install on or after 2026-03-31 and resolved axios to 1.14.1 or 0.30.4. Because the RAT beacons every 60 seconds and accepts interactive commands, exposure is measured in minutes, not days. A single compromised runner can exfiltrate npm tokens, GitHub PATs, SSH keys, cloud access keys, and signing certificates before the build even finishes.

It also matters strategically. axios is one of the most installed npm packages, with millions of weekly downloads. A short-window supply chain attack against a package this widely deployed demonstrates that npm publishing trust, even for mature projects, can be momentarily subverted. Your CI/dev workflows must be engineered to survive that assumption.

What you will learn

• Exactly which axios versions were compromised and how the RAT was delivered.
• The indicators of compromise (IOCs) to sweep across hosts, runners, and images.
• A copy-paste containment and recovery sequence, including secret rotation scope.
• A npm 14-day freshness policy you can codify in .npmrc and CI policy.
• Hardening controls that reduce blast radius for the next supply chain incident.

How the axios compromise worked

The attack was a maintainer account takeover, not a source code backdoor. On March 31, 2026, an attacker with control of a maintainer account published two new axios releases directly to npm: 1.14.1 and 0.30.4. Both releases added a runtime dependency on plain-crypto-js@4.2.1, a package that did not exist in prior axios dependency trees.

When a host ran npm install and resolved either malicious axios version, npm also fetched plain-crypto-js@4.2.1. That package declared a postinstall script, which npm executes automatically unless install scripts are disabled. The postinstall script downloaded and executed a cross-platform remote access trojan.

RAT behavior:

• Beaconed to sfrclak.com (142.11.206.73) every 60 seconds.
• Accepted attacker commands, including arbitrary shell execution and file exfiltration.
• Targeted host-accessible secrets: npm tokens, Git credentials, SSH keys, cloud keys, .env files, and secret manager credentials reachable from the host.
• Persisted on disk and re-executed across reboots where possible.

The malicious versions were live on npm for approximately 3 hours before being removed. axios was not backdoored at source; the canonical repository and prior releases remained clean. Safe versions are 1.14.0 and 0.30.3.

Indicators of compromise

Sweep for the following IOCs across every developer workstation, CI runner, build server, and container image built on or after 2026-03-31.

Malicious packages and versions:

• axios@1.14.1
• axios@0.30.4
• plain-crypto-js@4.2.1

Network indicators:

• Outbound connections to sfrclak.com
• Outbound connections to 142.11.206.73
• Any npm install step contacting a non-registry host during the attack window

Host artifacts:

• node_modules/plain-crypto-js directories
• Unexpected postinstall log lines referencing plain-crypto-js
• New or unexplained binaries in user-writable runtime paths
• Scheduled tasks or launch agents created during the attack window

Run a quick filesystem sweep:

find . -type d -name "plain-crypto-js" 2>/dev/null
find . -path "*/node_modules/axios/package.json" -exec grep -l '"version": "1.14.1"' {} \;
find . -path "*/node_modules/axios/package.json" -exec grep -l '"version": "0.30.4"' {} \;

Detection and triage checklist

Use this checklist to scope exposure quickly. The goal is a yes/no answer per host within the first hour.

• Identify every host that ran npm install on or after 2026-03-31.
• Check package-lock.json and yarn.lock files for axios@1.14.1, axios@0.30.4, or plain-crypto-js@4.2.1.
• Search CI workflow run logs for outbound connections to sfrclak.com or 142.11.206.73.
• Inspect egress telemetry: GitHub Actions Harden-Runner, GitLab network policies, Buildkite agent egress logs.
• Scan cached workflow artifacts and runner images for the malicious package directories.
• Review npm install logs for any postinstall output referencing plain-crypto-js.
• Check endpoint telemetry for new binaries or persistence mechanisms created during the attack window.
• Confirm whether install scripts were enabled on affected hosts (default npm behavior).

If any indicator is present, treat the host as compromised and move to containment immediately. For a structured sweep baseline, schedule a free security assessment.

Containment and recovery steps

Work through these steps in order. Do not skip secret rotation even if no active C2 is observed, because the RAT accepts commands and exfiltrates on a 60-second cadence.

1. Pin axios to a safe version.

npm install axios@1.14.0 --save-exact
# or for legacy 0.30.x lines
npm install axios@0.30.3 --save-exact

2. Remove the malicious dependency everywhere.

find . -type d -name "plain-crypto-js" -exec rm -rf {} +
npm ci

3. Disable axios auto-updates.

Remove axios from any automated dependency update tooling (Renovate, Dependabot, custom scripts) until the 14-day freshness policy is enforced. Pin the version explicitly in package.json.

4. Rotate every credential that touched an affected host.

Rotate, at minimum:

• npm access tokens (publish and install tokens)
• GitHub personal access tokens and GitHub App tokens
• SSH private keys
• Cloud access keys (AWS, GCP, Azure)
• CI/CD deploy tokens and registry tokens
• Code signing certificates
• Application secrets in .env files or secret managers accessed from the host

Re-issue and redistribute secrets from a clean, isolated system that was not exposed to the compromised package.

5. Rebuild runners and images from clean baselines.

Redeploy CI runners from a clean image. Rebuild container images from a known-good base, then run npm ci against a pinned, verified lockfile. Do not trust cached layers built during the attack window.

6. Escalate if stage-2 artifacts or active C2 are found.

If you find persistence mechanisms, active C2 connections, or evidence of lateral movement, escalate to a full incident response. Engage an MDR provider for scoping. For immediate response routing when active C2 is confirmed, use help, I’ve been hacked.

npm 14-day freshness policy

To reduce exposure to future supply chain attacks, adopt a 14-day freshness policy: no npm package or version is used in routine builds until it has been published for at least 14 days. Frame any urgent exception as a documented break-glass approval with validation.

Add this to your project .npmrc to make the policy visible to every contributor:

# npm 14-day freshness policy
# No package version younger than 14 days is allowed in routine builds.
# Urgent exceptions require documented break-glass approval and validation.
# Tooling: use npm-audit, socket.dev, or a custom pre-install hook to enforce.

Enforce it in CI with a pre-install check. Example GitHub Actions step:

- name: Enforce 14-day npm freshness policy
  run: |
    node scripts/check-npm-freshness.mjs
  env:
    NODE_ENV: production

A minimal check script can query the npm registry for each dependency’s time field and fail the build if any resolved version is younger than 14 days, unless an allowlist or break-glass flag is set. Treat break-glass as a logged, reviewed, time-boxed exception, not a standing override.

Hardening your CI pipeline

Supply chain attacks like this one exploit default trust. The following controls reduce blast radius without blocking productivity.

Disable install scripts by default.

# .npmrc
ignore-scripts=true

Re-enable scripts only for packages on an explicit allowlist after review. This single change would have blocked the plain-crypto-js postinstall RAT.

Use npm trusted publishing where available.

Prefer packages that publish via npm trusted publishing with short-lived OIDC tokens, which removes long-lived publish credentials that can be phished or stolen.

Pin and verify lockfiles.

Use npm ci instead of npm install in CI. Commit and review package-lock.json. Enable lockfile-only mode to prevent silent dependency mutation.

Restrict CI egress.

Block outbound traffic from CI runners to arbitrary internet hosts. Allow only the npm registry and your internal artifact store. Tools like GitHub Actions Harden-Runner make egress telemetry visible and enforceable.

Maintain a dependency allowlist.

Use a private npm proxy or an allowlist tool to block new, unvetted packages by default. plain-crypto-js@4.2.1 was a new dependency that appeared only in the malicious axios versions; an allowlist would have flagged it.

Cost of inaction

The RAT beacons every 60 seconds. Within the first minute of execution on a CI runner, attacker commands can run and credentials can leave the host. The realistic cost of inaction is not a delayed build; it is credential exfiltration, follow-on repository or cloud account compromise, and a full incident response engagement.

Quantified exposure for a single unrotated runner:

• npm publish token: can publish further malicious versions under your scope.
• GitHub PAT with write scope: can modify workflows, steal source, or push backdoors.
• Cloud access keys: can spin up infrastructure, exfiltrate data, or pivot to production.
• Signing certificates: can sign malware that passes your verification gates.

The difference between a 10-minute IOC sweep and a 10-day delayed response is typically the difference between a contained supply chain incident and a multi-system breach. If you want a structured baseline before committing to a longer engagement, book a free security assessment and start with a security scorecard. For a guided 30-day plan, schedule your assessment with our team.

Is axios safe to use after this incident

Yes. axios was not backdoored at source. The compromise was confined to two published versions, 1.14.1 and 0.30.4, removed from npm within roughly 3 hours. Safe versions are 1.14.0 and 0.30.3. The project is hardening its publishing pipeline, including moves toward npm trusted publishing with short-lived OIDC tokens. Apply the 14-day freshness policy to any future axios release before routine adoption. To pressure-test your response path, book a free security assessment.

How do I know if my CI runners were hit

Check CI logs for outbound connections to sfrclak.com or 142.11.206.73 during the March 31, 2026 attack window. Inspect workflow run network telemetry for any npm install step that contacted a non-registry host. Search cached workflow artifacts and runner images for axios@1.14.1, axios@0.30.4, or plain-crypto-js@4.2.1. Query egress logs for the C2 domain and IP. Any hit means the runner should be treated as compromised, redeployed from a clean image, and have its secrets rotated. For a structured sweep baseline, schedule a free security assessment.

Do I need to rotate all secrets

Yes, for any host that ran npm install while the malicious versions were available. The RAT accepts attacker commands and beacons every 60 seconds, so credential exfiltration should be assumed to have begun within the first minute of execution. Rotate npm tokens, GitHub PATs, SSH keys, cloud access keys, CI/CD deploy tokens, signing certificates, and any application secrets present in .env files or secret managers accessed from the host. Re-issue and redistribute secrets from a clean, isolated system that was not exposed to the compromised package.

Should we block axios entirely

No. axios was not backdoored at source, and the compromise was confined to two versions. Blocking or abandoning axios would create widespread breakage and push teams toward less-vetted alternatives. Pin to safe versions 1.14.0 or 0.30.3, disable auto-updates, and apply the 14-day freshness policy to future releases. Treat this as a process failure to fix, not a package to abandon.

What should we do next

Run the IOC sweep across every developer workstation, CI runner, build server, and container image built on or after 2026-03-31. Pin axios to 1.14.0 or 0.30.3, delete node_modules/plain-crypto-js everywhere, disable axios auto-updates, and rotate every credential that touched an affected host. If stage-2 artifacts or active C2 connections are found, escalate to a full incident response and engage an MDR provider for scoping. For a structured baseline before a longer engagement, book a free security assessment and start with a security scorecard.

Get your free security assessment

If this axios, compromised, npm, RAT, trojan, remote access, is a live priority for your team, schedule your assessment for a focused review. We will map the biggest gaps, assign the first actions, and turn the article into a practical 30-day plan.

Next steps

Run the IOC sweep across every developer workstation, CI runner, build server, and container image built on or after 2026-03-31. Pin axios to 1.14.0 or 0.30.3, delete node_modules/plain-crypto-js everywhere, disable axios auto-updates, and rotate every credential that touched an affected host. If stage-2 artifacts or active C2 connections are found, escalate to a full incident response and engage an MDR provider for scoping. For a structured baseline before a longer engagement, book a free security assessment and review your posture with a security scorecard. If you need broader detection and response coverage, explore our managed security service provider program, and for immediate response routing when active C2 is confirmed, use help, I’ve been hacked.

References

• npm Documentation: package.json postinstall scripts
• GitHub Blog: Open source supply chain security
• CISA: Supply Chain Risk Management resources
• OpenSSF: Secure Software Development Practices
• npm Blog: Trusted Publishing on npm
• OWASP: Dependency Management Cheat Sheet
• SLSA Framework: Supply chain integrity levels
• CyberReplay: Managed Security Service Provider
• CyberReplay: Help, I’ve Been Hacked
• CyberReplay: Security Scorecard

Definitions

• axios: A widely used JavaScript HTTP client library distributed on npm, used in browser and Node.js applications.
• compromised (npm): A state in which a maintainer account or publish credential is hijacked and used to publish tampered package versions to the npm registry.
• npm: The Node Package Manager registry and CLI tool used to install, publish, and manage JavaScript dependencies.
• RAT (remote access trojan): Malware that grants an attacker remote control of a host, typically beaconing to a command-and-control server and accepting commands such as shell execution and file exfiltration.
• trojan: Malware disguised as legitimate software; in this incident, the malicious payload was hidden inside a postinstall script of a dependency.
• remote access: The capability exercised by the RAT to let an attacker run commands on a victim host from a remote C2 server.
• postinstall script: An npm lifecycle script that runs automatically after a package is installed unless install scripts are disabled.
• IOC (indicator of compromise): An artifact, network signature, or host artifact that signals a system was affected by an attack.
• C2 (command and control): The server a RAT contacts to receive attacker instructions; in this incident, sfrclak.com (142.11.206.73).
• 14-day freshness policy: A control that blocks any npm package version younger than 14 days from routine builds unless a documented break-glass exception is approved.

For a glossary tuned to your stack, book a free security assessment.

Common mistakes

• Trusting cached CI layers and runner images from the attack window. Layers built while axios@1.14.1 or axios@0.30.4 were live can carry the malicious dependency. Rebuild from clean baselines instead.
• Skipping secret rotation because no active C2 was observed. The RAT beacons every 60 seconds and accepts exfiltration commands, so credential exposure should be assumed within the first minute of execution.
• Assuming axios was backdoored at source. Only the two published versions were tampered. The canonical repository and prior releases remained clean; abandoning axios entirely creates breakage without reducing risk.
• Leaving install scripts enabled by default. npm runs postinstall scripts unless ignore-scripts=true is set, which is exactly the lever the plain-crypto-js payload relied on.
• Relying on auto-updates during the incident. Renovate, Dependabot, or custom update scripts can pull a freshly published malicious version within minutes of release. Pin axios explicitly and disable auto-updates until the 14-day freshness policy is enforced.
• Only sweeping production, not developer workstations. Any host that ran npm install on or after 2026-03-31 is in scope, including laptops and local build sandboxes.
• Rotating secrets from the same compromised host. Re-issue npm tokens, GitHub PATs, SSH keys, and cloud keys from a clean, isolated system that was not exposed to the malicious package.

If any of these mistakes match your current state, book a free security assessment to scope remediation.

FAQ

Q: Is axios safe to use after this incident? A: Yes. axios was not backdoored at source. The compromise was confined to two published versions, 1.14.1 and 0.30.4, removed from npm within roughly 3 hours. Safe versions are 1.14.0 and 0.30.3. Apply the 14-day freshness policy to any future axios release before routine adoption. To pressure-test your response path, book a free security assessment.

Q: How do I know if my CI runners were hit? A: Check CI logs for outbound connections to sfrclak.com or 142.11.206.73 during the March 31, 2026 attack window. Inspect workflow run network telemetry for any npm install step that contacted a non-registry host. Search cached workflow artifacts and runner images for axios@1.14.1, axios@0.30.4, or plain-crypto-js@4.2.1. Any hit means the runner should be treated as compromised, redeployed from a clean image, and have its secrets rotated. For a structured sweep baseline, schedule a free security assessment.

Q: Do I need to rotate all secrets? A: Yes, for any host that ran npm install while the malicious versions were available. The RAT accepts attacker commands and beacons every 60 seconds, so credential exfiltration should be assumed to have begun within the first minute of execution. Rotate npm tokens, GitHub PATs, SSH keys, cloud access keys, CI/CD deploy tokens, signing certificates, and any application secrets present in .env files or secret managers accessed from the host. Re-issue from a clean, isolated system.

Q: Should we block axios entirely? A: No. axios was not backdoored at source, and the compromise was confined to two versions. Blocking or abandoning axios would create widespread breakage and push teams toward less-vetted alternatives. Pin to safe versions 1.14.0 or 0.30.3, disable auto-updates, and apply the 14-day freshness policy to future releases.

Q: What should we do next? A: Run the IOC sweep across every developer workstation, CI runner, build server, and container image built on or after 2026-03-31. Pin axios to 1.14.0 or 0.30.3, delete node_modules/plain-crypto-js everywhere, disable axios auto-updates, and rotate every credential that touched an affected host. If stage-2 artifacts or active C2 connections are found, escalate to a full incident response and engage an MDR provider. For a structured baseline, book a free security assessment and start with a security scorecard.