The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding a severe software supply chain compromise affecting the widely used Axios node package manager (npm).
Axios is a highly popular JavaScript library that developers rely on to handle HTTP requests in both Node.js and browser environments.
Because of its massive global adoption rate, this security breach represents a significant threat to development pipelines, potentially putting countless enterprise applications at risk.
The breach occurred on March 31, 2026, when threat actors successfully poisoned two specific updates of the Axios package: versions 1.14.1 and 0.30.4.
Whenever developers updated to these compromised versions, the system quietly pulled in an injected malicious dependency called plain-crypto-js version 4.2.1.
This hidden package acts as a stealthy loader, reaching out to external threat actor infrastructure to download multi-stage payloads.
The primary payload deployed is a remote access trojan (RAT) that gives attackers persistent control over infected machines.
For example, if a developer’s machine is compromised, the RAT can quietly harvest sensitive source code, steal environment variables, or pivot deeper into the corporate network to access continuous integration and continuous delivery (CI/CD) pipelines.
Compromised Axios npm Package
CISA strongly urges all organizations to carefully review their code repositories and developer machines to identify any systems that recently ran npm package updates.
If your team inadvertently pulled the malicious Axios versions, you should implement these critical incident response measures immediately to secure your network.
- Downgrade your environment to known safe Axios releases, specifically version 1.14.0 or 0.30.3.
- Locate and securely delete the node_modules/plain-crypto-js/ directory from all affected projects.
- Revoke and rotate any credentials exposed on impacted systems, including cloud keys, CI/CD secrets, npm tokens, and SSH keys.
- Monitor your network infrastructure for any outbound connections routing to the known malicious domain Sfrclak[.]com.
- Conduct thorough endpoint detection and response (EDR) hunts to ensure no active command and control communication remains hidden in the background.
Beyond cleaning up the immediate infection, organizations must take proactive steps to prevent similar software supply chain attacks from succeeding in the future.
Supply chain vulnerabilities frequently exploit default package manager behaviors, but security teams can reconfigure npm to block unauthorized script execution and delay unverified packages.
- Enforce phishing-resistant multifactor authentication across all developer accounts to protect critical deployment platforms.
- Set ignore-scripts=true in your .npmrc file to stop packages from automatically running malicious setup scripts during installation.
- Configure min-release-age=7 in .npmrc to strictly block the installation of packages published less than seven days ago.
- Establish a strict baseline of normal behavior for your build tools to quickly spot anomalous activity, such as unexpected child processes or unusual external connections.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
.){kind=link}