Axios Compromised: The Most Popular HTTP Client in JavaScript Was Backdoored With a Self-Deleting RAT. 100 Million Weekly Downloads. Both Branches Poisoned in 39 Minutes.

The Story

The attack was methodical. On March 30 at 05:57 UTC, a clean version of plain-crypto-js@4.2.0 was published to npm by user "nrwise" (nrwise@proton.me). This was a faithful copy of the legitimate crypto-js library with the same description, author name, and repository URL. It contained no malicious code. It existed to establish a credible package identity on npm.

Eighteen hours later, at 23:59 UTC on March 30, plain-crypto-js@4.2.1 was published. This version contained the malicious postinstall script. The dependency was now staged and ready.

At 00:21 UTC on March 31, the attacker used the compromised "jasonsaayman" npm account to publish axios@1.14.1. At 01:00 UTC, axios@0.30.4 followed. Both the 1.x and 0.x release branches were poisoned within 39 minutes. Neither version went through Axios's standard GitHub Actions CI/CD pipeline. They were published directly via the npm CLI using the stolen account credentials. No corresponding GitHub tags exist for these versions.

The malicious versions of Axios contain no changes to the Axios source code itself. The only modification is the addition of plain-crypto-js@4.2.1 as a dependency in package.json. This dependency is never imported by Axios. It exists solely to execute its postinstall hook during npm install.

Wiz reported that Axios is present in approximately 80% of cloud and code environments they monitor, and confirmed execution of the malicious versions in 3% of affected environments during the brief window before removal. Socket's automated malware detection flagged the malicious plain-crypto-js package within 6 minutes of publication. The malicious versions were removed from npm within hours, but the damage window was real.

Help Net Security noted that the absence of cryptocurrency mining or ransomware components, combined with the operational sophistication of the attack, "indicates that this is not financially motivated cybercrime, but rather espionage or advanced persistent threat (APT) activity." The attack is not currently attributed to TeamPCP or any known threat actor.

The Adversary Perspective

This is one of the most technically sophisticated npm supply chain attacks ever documented. Four design choices reveal a highly capable operator.

First, the dependency injection model avoids touching Axios source code. The attacker did not modify any Axios JavaScript files. They added a single line to package.json introducing a new dependency. This means code review tools, diff analysis, and source integrity checks that compare .js files against the GitHub repository would not detect the compromise. The malicious behavior lives entirely in the dependency's postinstall hook, one level removed from the package the developer trusts.

Second, the anti-forensic self-deletion is unusually thorough. After execution, the dropper deletes setup.js, removes the package.json that contained the postinstall hook, and replaces it with a clean version. Anyone inspecting node_modules/plain-crypto-js after the fact sees a completely innocent-looking package. The only forensic indicator is the presence of the plain-crypto-js directory itself in node_modules, which most developers would not recognize as anomalous. The entire install-to-cleanup cycle completes in 36 seconds.

Third, the RAT is purpose-built for developer machine compromise. Each platform variant is tailored. The macOS RAT disguises itself as com.apple.act.mond, spoofing Apple's background daemon naming convention. The Windows variant copies PowerShell to a non-standard location and executes hidden scripts. The Linux variant uses a Python script. All three beacon to C2 every 60 seconds using a fake IE8/Windows XP User-Agent string to blend with common web traffic patterns. The RAT supports commands for system fingerprinting, credential harvesting, process injection, and arbitrary code execution.

Fourth, the staging and timing demonstrate deliberate operational planning. The clean dependency was published 18 hours before the malicious version. The account email was changed to lock out the legitimate maintainer. Both release branches were hit in 39 minutes to maximize the window before detection. The attack was designed to execute, persist, and clean up before the ecosystem's automated detection systems could intervene at scale. Socket caught it in 6 minutes, but the attacker anticipated this. The 36-second cleanup cycle means that by the time a detection alert fires, the evidence is already gone from the package directory.

Defensive Takeaways