---
title: "GHSA-3hfp-gqgh-xc5g: Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions"
url: https://erroneo.us/security/ghsa/GHSA-3hfp-gqgh-xc5g/
description: "GHSA-3hfp-gqgh-xc5g (critical, npm): Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions. Impact A supply…"
type: advisory
section: "Security Digest"
date_published: 2026-04-02
date_modified: 2026-04-02
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-3hfp-gqgh-xc5g"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-3hfp-gqgh-xc5g: Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions

## Affected packages

- npm `@lightdash/cli` >= 0.1800.0, < 0.2695.1 → fixed: 0.2695.1

## Details

Impact A supply chain attack on the axios npm package (versions 1.14.1 and 0.30.4) introduced a malicious transitive dependency (plain-crypto-js@4.2.1) that deploys a cross-platform remote access trojan (RAT) on macOS, Windows, and Linux. The attacker compromised the primary axios maintainer's npm account to publish the malicious versions. The malicious versions were live on npm for approximately 3 hours (00:21 UTC to 03:29 UTC on March 31, 2026) before being removed. The @lightdash/cli package specified axios as a dependency with a semver range (^1.12.0) that permitted resolution to the compromised version. Any user who performed a fresh install of @lightdash/cli versions >= 0.1800.0,

## Sources

- [GitHub Advisory GHSA-3hfp-gqgh-xc5g](https://github.com/advisories/GHSA-3hfp-gqgh-xc5g)
- [github.com](https://github.com/lightdash/lightdash/security/advisories/GHSA-3hfp-gqgh-xc5g)
- [github.com](https://github.com/axios/axios/issues/10604)
- [github.com](https://github.com/advisories/GHSA-fw8c-xr5c-95f9)
- [security.snyk.io](https://security.snyk.io/vuln/SNYK-JS-AXIOS-15850650)
- [security.snyk.io](https://security.snyk.io/vuln/SNYK-JS-PLAINCRYPTOJS-15850652)
- [socket.dev](https://socket.dev/blog/axios-npm-package-compromised)
- [thehackernews.com](https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html)
- [stepsecurity.io](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan)

---
Source page: https://erroneo.us/security/ghsa/GHSA-3hfp-gqgh-xc5g/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt