axios 1.14.1 and 0.30.4: npm Hijack Drops North Korean RAT

What to do

1. Search all lockfiles (package-lock, yarn.lock, pnpm-lock.yaml, bun.lock) for axios 1.14.1, 0.30.4 and plain-crypto-js
2. Treat any host that installed them as fully compromised: isolate, rebuild from a clean image
3. Rotate every credential present on that host or injected into affected CI jobs
4. Block sfrclak[.]com and 142.11.206.73 and search proxy logs for past connections
5. Enable a release-age cooldown (npm min-release-age, pnpm minimum-release-age, Yarn npmMinimalAgeGate)

How to check if you are affected or compromised

• grep -nE 'axios@?("|-)?(1\.14\.1|0\.30\.4)|plain-crypto-js' package-lock.json yarn.lock pnpm-lock.yaml bun.lock
• ls node_modules/plain-crypto-js; npm ls axios --all
• macOS: ls -la /Library/Caches/com.apple.act.mond; Linux: ls -la /tmp/ld.py; Windows: dir %PROGRAMDATA%\wt.exe %PROGRAMDATA%\system.bat and HKCU Run key 'MicrosoftUpdate'
• Network: connections to sfrclak[.]com or 142.11.206.73:8000

What happened#

Early on March 31, 2026, an attacker used the hijacked npm account of axios's lead maintainer to publish two malicious releases of the most widely used JavaScript HTTP client: axios@1.14.1 at 00:21 UTC and axios@0.30.4 at about 01:00 UTC. Neither release changed axios's own code. Each added one dependency, plain-crypto-js@4.2.1, whose postinstall hook dropped a cross-platform remote-access trojan. The attacker had seeded a clean plain-crypto-js@4.2.0 the day before so the package name would look established. According to the axios post-mortem, npm removed both axios versions at 03:15 UTC and plain-crypto-js at 03:29 UTC. The attacker deleted the first community issues reporting the problem while the releases were still live.

Access came from social engineering, not a leaked token. The maintainer describes a roughly two-week campaign: a cloned company founder, a convincing branded Slack workspace, and a Teams call that prompted him to install a "missing" component, which was a RAT. With full control of his machine, the attacker could publish despite 2FA. Google's Threat Intelligence Group attributes the operation to UNC1069, a financially motivated North Korea-nexus group, as summarized by Tenable.

Who is affected#

Tenable cites more than 100 million weekly downloads for the axios 1.x line and more than 83 million for 0.x, and hundreds of packages depend on axios. StepSecurity reported anomalous C2 contact from more than 12,000 projects it monitors. You were exposed only if a fresh resolution picked up 1.14.1 or 0.30.4 in the roughly three-hour window. That could happen through npm install with a caret range and no lockfile, a lockfile refresh, a Renovate or Dependabot run, or an npx call that resolves at runtime. GitHub tracks it as GHSA-fw8c-xr5c-95f9. No CVE was assigned.

Do you really need to act?#

Most teams only need to confirm. A committed lockfile that resolved axios before March 31 and was not refreshed during the window means no exposure. The maintainers say the same. If you did resolve a bad version, though, this is not a "rotate one token" event. The payload is a general-purpose RAT, which Tenable's summary of Google's analysis calls WAVESHAPER.V2. It beacons every 60 seconds and accepts commands to run scripts and inject binaries. Treat the host as attacker-controlled from that moment until rebuilt. The dropper deletes itself and restores a clean-looking package.json, so the absence of the malicious package in node_modules today proves nothing. Rely on lockfile history, logs and host artifacts.

What to do now#

1. Search every lockfile, including history: git log -p --since=2026-03-30 --until=2026-04-02 -- '*lock*' | grep -E 'axios|plain-crypto-js'. Also check CI logs for installs between 00:21 and 03:15 UTC on March 31.
2. Pin to axios@1.14.0 or 0.30.3, or any later clean release, and delete node_modules/plain-crypto-js/.
3. For any hit: isolate the host and rebuild it from a clean image. Then rotate every secret it held (SSH keys, cloud credentials, npm/GitHub tokens, browser-saved sessions). On CI, rotate secrets injected into affected jobs, and treat self-hosted runners as compromised.
4. Block sfrclak[.]com and 142.11.206.73, and search historical DNS and proxy logs for them.
5. Add a release-age gate: min-release-age=7d in .npmrc (npm 11.10+), minimum-release-age in pnpm 10.16+, or npmMinimalAgeGate in Yarn 4.10+. Socket flagged this package within minutes, so even a one-day delay would have avoided it.

How to tell if you were hit#

Host artifacts listed by Tenable: /Library/Caches/com.apple.act.mond on macOS; %PROGRAMDATA%\wt.exe, %PROGRAMDATA%\system.bat and a Run key named "MicrosoftUpdate" on Windows; and /tmp/ld.py started with nohup on Linux. Network: HTTP beacons to sfrclak[.]com or 142.11.206.73:8000 with an old IE8/Windows XP User-Agent. Google publishes hashes and YARA rules for the dropper (SILKBELL) and the RAT.

Timeline#

• Mar 30, 2026 — Clean decoy plain-crypto-js 4.2.0 published at 05:57 UTC; malicious version follows late that night.
• Mar 31, 2026 — axios 1.14.1 (00:21 UTC) and 0.30.4 (about 01:00) published; GHSA filed; versions removed at 03:15 and plain-crypto-js at 03:29. The maintainer later posts a post-mortem (devices wiped, OIDC publishing and immutable releases adopted).

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. axios — Post Mortem: axios npm supply chain compromise (issue #10636) github.com
2. GitHub Advisory — GHSA-fw8c-xr5c-95f9 Malware in axios github.com
3. Tenable — FAQ about the axios npm supply chain attack by North Korea-nexus threat actor UNC1069 tenable.com