Axios npm Supply Chain Attack Delivers Cross‑Platform RAT

Executive Summary

Attackers hijacked the axios npm package using a stolen token and added a ghost dependency. The dependency deployed a cross-platform RAT with anti-forensic “self-healing” behaviour.

Key Details

Affected Platform

Attack Surface

Recommended Action

Affected Environment

Organisations using axios npm 1.14.1 or 0.30.4, and any build chains that pulled these. Any environment with node_modules/plain-crypto-js present should be treated as exposed.

Operational Impact

Compromise enables remote access, persistence, process inventory and data exfiltration. macOS, Windows and Linux hosts may be affected, including development and CI systems.

Technical Root Cause

Attackers used a long-lived npm access token to bypass GitHub OIDC safeguards. Malicious packages were manually published, missing trustedPublisher and gitHead fields.

Recommended Mitigation

Remove malicious axios versions and plain-crypto-js; downgrade to axios 1.14.0 or 0.30.0.
Use overrides to block these versions, rotate all secrets, and block listed C2 indicators.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Incident Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Source details are in Smarttech247 research and cited public analyses of the axios attack. Key references include reports from The Hacker News, Aikido, StepSecurity, and OX Security.