Executive Summary
In late March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely-used JavaScript HTTP client library. They published two malicious versions, axios@1.14.1 and axios@0.30.4, which included a trojanized dependency named plain-crypto-js. This dependency executed a postinstall script that downloaded and installed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux systems. The malicious packages were available for approximately three hours before being removed by npm. (tomshardware.com)
This incident underscores the growing threat of supply chain attacks targeting open-source software repositories. The rapid deployment and removal of the malicious packages highlight the need for vigilant monitoring and swift response mechanisms within the software development community.
Why This Matters Now
The Axios npm compromise exemplifies the increasing sophistication of supply chain attacks, emphasizing the urgent need for enhanced security measures in open-source software development and distribution.
Attack Path Analysis
Attackers compromised the npm account of an Axios maintainer, publishing malicious versions of the package. These versions included a trojanized dependency that, upon installation, executed a Remote Access Trojan (RAT) to establish control over infected systems. The RAT enabled attackers to exfiltrate sensitive data and potentially disrupt operations.
Kill Chain Progression
Initial Compromise
Description
Attackers gained access to the npm account of an Axios maintainer and published malicious versions of the package.
MITRE ATT&CK® Techniques
Supply Chain Compromise
Search Open Websites/Domains: Code Repositories
Data from Information Repositories: Code Repositories
Masquerading
Event Triggered Execution: Installer Packages
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 – Supply Chain Protection
Control ID: SA-12
PCI DSS 4.0 – Establish a process to identify security vulnerabilities
Control ID: 6.1
NYDFS 23 NYCRR 500 – Application Security
Control ID: 500.08
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA Zero Trust Maturity Model 2.0 – Implement Secure Software Development Practices
Control ID: Pillar 3: Applications and Workloads
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical exposure to malicious packages in npm/PyPI supply chains requires immediate OSV API integration and enhanced dependency scanning protocols.
Information Technology/IT
Supply-chain attacks targeting development dependencies demand robust package verification, lockfile enforcement, and automated malicious package detection systems.
Banking/Mortgage
Financial institutions face elevated risks from compromised open-source dependencies affecting PCI compliance and requiring enhanced zero-trust segmentation controls.
Health Care / Life Sciences
Healthcare systems must implement OSV scanning for HIPAA compliance while preventing malicious package infiltration through Kubernetes and cloud-native security fabrics.
Sources
- Detecting Malicious Packages using the OSV APIhttps://openssf.org/blog/2026/05/20/detecting-malicious-packages-using-the-osv-api/Verified
- One of JavaScript's most popular libraries compromised by hackers — Axios npm package hit in supply chain attack that deployed a cross-platform RAThttps://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-ratVerified
- LiteLLM PyPI Package Compromisehttps://digital.nhs.uk/cyber-alerts/2026/cc-4761Verified
- Axios compromised: hijacked maintainer account pushes malicious npm versionshttps://www.endorlabs.com/learn/npm-axios-compromiseVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have limited the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and controlled egress policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While Aviatrix Zero Trust CNSF may not prevent the initial compromise of the npm account, it could limit the subsequent impact by restricting unauthorized communications from the compromised package.
Control: Zero Trust Segmentation
Mitigation: Aviatrix Zero Trust Segmentation could likely limit the RAT's ability to escalate privileges by enforcing strict access controls and segmenting workloads.
Control: East-West Traffic Security
Mitigation: Aviatrix East-West Traffic Security could likely restrict lateral movement by controlling and monitoring internal traffic between workloads.
Control: Multicloud Visibility & Control
Mitigation: Aviatrix Multicloud Visibility & Control could likely detect and limit unauthorized outbound connections to command-and-control servers.
Control: Egress Security & Policy Enforcement
Mitigation: Aviatrix Egress Security & Policy Enforcement could likely limit data exfiltration by controlling and monitoring outbound data flows.
While Aviatrix Zero Trust CNSF may not prevent the initial compromise, it could likely limit the overall impact by restricting the attacker's ability to move laterally and exfiltrate data.
Impact at a Glance
Affected Business Functions
- Software Development
- Continuous Integration/Continuous Deployment (CI/CD) Pipelines
- Application Security
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of developer credentials, API keys, and access tokens due to the execution of remote access trojans and information stealers embedded in the malicious packages.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to limit the impact of compromised accounts.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic.
- • Utilize Threat Detection & Anomaly Response to identify and respond to malicious activities.
- • Apply Inline IPS (Suricata) to detect and prevent known exploit patterns.
- • Ensure Multicloud Visibility & Control to maintain oversight across all cloud environments.
