Axios Front-End Library npm Supply Chain Poisoning Alert
Essential information
- Published
- 01/04/2026 15:16
- Modified
- 01/04/2026 15:26
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- axios npm supply chain supply chain attack
- Tags
- 2026-04-01 axios npm supply chain attack supply-chain
- Related entities
- 3 indicators, 3 observables, 2 others
Description
On March 31, NSFOCUS CERT detected that the npm repository of the HTTP client library Axios was poisoned by the supply chain. The attacker bypassed the normal GitHub Actions CI/CD pipeline of the project, changed the account email address of the axios maintainer to an anonymous ProtonMail address, and manually released a malicious version with a Trojan backdoor through the npm CLI. When the user installs it, a persistent remote control will be established on the host. The impact is wide-ranging, and relevant users are requested to take measures for investigation and protection as soon as possible.