Sponsor of the Day:
Jerkmate
https://laravel-news.com/axios-npm-package-compromised-with-remote-access-trojan
Axios npm Package Compromised With Remote Access Trojan - Laravel News
Apr 3, 2026 - Malicious versions of the axios HTTP client were published to npm on March 31, 2026, deploying a cross-platform remote access trojan via a fake dependency.
axios npm packageremote access trojanlaravel newscompromised
https://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-rat
One of JavaScript's most popular libraries compromised by hackers — Axios npm package hit in supply...
Mar 31, 2026 - The hijacked maintainer account was used to publish two malicious versions of one of JavaScript's most popular libraries.
axios npm packageonejavascriptpopularlibraries
https://ramimac.me/axios/
Axios npm Supply Chain Attack
Apr 6, 2026 - Timeline and IOCs for the Axios npm supply chain attack. Compromised maintainer account, credential stealer via plain-crypto-js dependency.
axios npm supplychain attack
https://gbhackers.com/cisa-warns-compromised-axios-npm-package/
CISA Warns Compromised Axios npm Package Fueled Major Supply Chain Attack
Apr 21, 2026 - CISA has issued an urgent alert regarding a severe software supply chain compromise affecting the widely used Axios node package manager (npm).
axios npm packagesupply chain attackcisa warnscompromisedfueled
https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html
Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069
Google links Axios npm supply chain attack to UNC1069 after trojanized versions 1.14.1 and 0.30.4 spread WAVESHAPER.V2, impacting multiple OS.
axios npm supplychain attacknorth koreangoogleattributes
https://github.com/axios/axios/issues/10636
Post Mortem: axios npm supply chain compromise · Issue #10636 · axios/axios · GitHub
Post Mortem: axios npm supply chain compromise Date: March 31, 2026 Author: Jason Saayman Status: Remediation in progress On March 31, 2026, two malicious...
axios npm supplypost mortemchain compromiseissue10636
https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/
Compromised axios npm package delivers cross-platform RAT | Datadog Security Labs
An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT.
axios npm packagecross platform ratdatadog security labscompromiseddelivers
https://www.helpnetsecurity.com/2026/03/31/axios-npm-backdoored-supply-chain-attack/
Axios npm packages backdoored in supply chain attack - Help Net Security
Mar 31, 2026 - An attacker has published backdoored Axios npm packages that trigger the installation of droppers and remote access trojans.
supply chain attackaxios npmpackagesbackdooredhelp
https://www.huntress.com/blog/axios-npm-compromise
Tradecraft Tuesday Recap: axios npm Supply Chain Compromise | Huntress
A few weeks after the major axios npm supply chain attack, a group of researchers from Huntress, Wiz, and Aikido Security debriefed on the compromise’s lasting...
axios npm supplytuesday recapchain compromisetradecrafthuntress
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Axios NPM Package Compromised: Supply Chain Attack Hits JavaScript HTTP Client with 100M+ Weekly...
axios npm packagesupply chain attackhttp clientcompromisedhits
https://www.infoq.com/news/2026/04/axios-supply-chain/
Axios npm Package Compromised in Supply Chain Attack - InfoQ
Apr 2, 2026 - On March 31, 2026, two versions of the Axios library were compromised and found to contain a Remote Access Trojan. The malicious packages were published...
axios npm packagesupply chain attackcompromisedinfoq
https://www.helpnetsecurity.com/2026/04/05/week-in-review-axios-npm-supply-chain-compromise-critical-forticlient-ems-bug-exploited/
Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited - Help...
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Financial groups lay out a plan to fight AI identity
axios npm supplychain compromiseforticlient emsweekreview
https://www.tenable.com/blog/faq-about-the-axios-npm-supply-chain-attack-by-north-korea-nexus-threat-actor-unc1069
Axios npm Supply Chain Attack FAQ: North Korea UNC1069 | Tenable®
Apr 7, 2026 - North Korea-nexus threat actor UNC1069 compromised the axios npm package, delivering the WAVESHAPER.V2 RAT to macOS, Windows, and Linux systems.
axios npm supplychain attackfaq northkoreaunc1069
https://www.tenable.com/blog/supply-chain-attack-on-axios-npm-package-scope-impact-and-remediations
Axios npm supply chain attack | Tenable®
Apr 7, 2026 - The attacker injected a malicious package called “plain-crypto-js” into the dependency tree of Axios versions 1.14.1 and 0.30.4. Scan your environment now to...
axios npm supplychain attack
https://www.helpnetsecurity.com/2026/04/01/north-korean-hackers-linked-to-axios-npm-supply-chain-compromise/
North Korean hackers linked to Axios npm supply chain compromise - Help Net Security
The supply chain attack that lead to the compromise of Axios npm packages is likely the work of financially-motivated North Korean attackers.
north korean hackersaxios npm supplychain compromiselinkedhelp
https://netrouting.com/axios-npm-attack-ci-cd-security-risk/
Axios npm Supply Chain Attack: CI/CD & Infrastructure Risk Explained
Apr 6, 2026 - Axios npm attack exposes CI/CD risks. Learn how dependency installs can compromise infrastructure and how to secure your pipelines.
axios npm supplychain attackci cdrisk explainedinfrastructure
https://www.itpro.com/security/cyber-attacks/the-build-pipeline-is-becoming-the-new-frontline-axios-npm-compromise-highlights-growing-software-supply-chain-risks-experts-warn
‘The build pipeline is becoming the new frontline’: Axios npm compromise highlights growing...
Apr 1, 2026 - Attackers have compromised an Axios nom account and published malicious versions to spread remote access trojans (RATs) to millions of developers.
build pipelineaxios npmhighlights growingbecomingnew
https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-07
Kriittinen haavoittuvuus axios JavaScript -paketin npm-jakelussa | Traficom
Npm-jakelun kautta levitetyssä axios-paketissa oli muutaman tunnin ajan haitallinen riippuvuus. Haitallinen riippuvuuvs johti takaoven asentumiseen...
kriittinen haavoittuvuusaxiosjavascriptpaketinnpm
https://www.numerama.com/cyberguerre/2222059-piratage-axios-sur-npm-2-versions-malveillantes-glissees-en-pleine-nuit-diffusent-un-malware.html
Piratage Axios sur npm : 2 versions malveillantes diffusent un malware - Numerama
Mar 31, 2026 - Dans la nuit du 30 au 31 mars 2026, deux versions piégées d'Axios ont été publiées sur npm, la plateforme de distribution de code la plus utilisée au monde par...
2 versionsun malwarepiratageaxiossur
https://daringfireball.net/linked/2026/04/02/axios-attack
Daring Fireball: Axios, Super Popular NPM Package, Was Compromised in Attack on the Module's...
Link to: https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
daring fireballsuper popularnpm packageaxioscompromised
https://www.legitsecurity.com/blog/axios-hijacked-npm-account-takeover-deploys-cross-platform-rat-to-millions
Axios Hijacked: npm Account Takeover Deploys Cross-Platform RAT to Millions
Mar 31, 2026 - A security breach linked to a compromised Trivy binary exposed LiteLLM. Learn how to protect your infrastructure now.
cross platform rataccount takeoveraxioshijackednpm
https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html
Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account
Axios 1.14.1 and 0.30.4 injected malicious plain-crypto-js@4.2.1 after npm compromise on March 31, 2026, deploying cross-platform RAT malware.
axios supply chaincross platform ratvia compromisedattackpushes
https://www.sonatype.com/blog/axios-compromise-on-npm-introduces-hidden-malicious-package
Axios Compromise on npm Introduces Hidden Malicious Package
Apr 2, 2026 - Malicious axios versions introduced a hidden dependency, exposing systems via npm supply chain attack, targeting trusted packages and dependencies.
axioscompromisenpmintroduceshidden
https://thehackernews.com/2026/04/unc1069-social-engineering-of-axios.html
UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack
UNC1069 compromised Axios 1.14.1 and 0.30.4 via social engineering, impacting 100M weekly downloads and exposing supply chains.
npm supply chainsocial engineeringunc1069axiosmaintainer
https://it.slashdot.org/story/26/04/05/0316250/top-npm-maintainers-targeted-with-ai-deepfakes-in-massive-supply-chain-attack-axios-briefly-compromised
Top NPM Maintainers Targeted with AI Deepfakes in Massive Supply-Chain Attack, Axios Briefly...
supply chain attacktopnpmmaintainerstargeted
https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat
axios compromised on npm: maintainer account hijacked, RAT deployed
Mar 31, 2026 - Malicious axios versions 1.14.1 and 0.30.4 were published via a hijacked maintainer account. A hidden dependency deploys a cross-platform RAT. Check if you are...
axioscompromisednpmmaintaineraccount