Axios npm Package Compromised in Supply Chain Attack
8.8 relevance
Score Breakdown
technical depth 9
novelty 7
actionability 10
community 9
strategic 9
personal 9
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
Compromise of a widely-used HTTP client library with RAT.
Summary
The Axios npm package (100M+ weekly downloads) was compromised in versions 1.14.1 and 0.30.4 via a hijacked maintainer account, injecting malware through the typosquatted plain-crypto-js@4.2.1 dependency. Socket's scanner detected the attack within six minutes, impacting projects with unpinned caret ranges like ^1.14.0. Mitigation requires immediate rollback, dependency pinning, and settings like ignore-scripts=true, with alternatives such as native fetch offering smaller attack surfaces.