On March 31, 2026, StepSecurity discovered two malicious versions of the popular axios HTTP client library published to npm: [email protected] and [email protected]. Both versions were published using compromised npm credentials from a lead axios maintainer, bypassing the project's normal GitHub Actions CI/CD pipeline. The attacker changed the maintainer's account email to an anonymous ProtonMail address and manually published the poisoned packages via npm CLI.

Neither malicious version contains malicious code inside axios itself. Instead, both inject a fake dependency, [email protected], which is never imported anywhere in the axios source code. Its sole purpose is to execute a postinstall script that acts as a cross-platform remote access trojan (RAT) dropper, targeting macOS, Windows, and Linux. The dropper contacts a live command and control server and delivers platform-specific second-stage payloads. After execution, the malware deletes itself and replaces its own package.json with a clean version to evade forensic detection.

If you have installed [email protected] or [email protected], assume your system is compromised. Pin to the safe versions: [email protected] (1.x branch) or [email protected] (0.x branch). Rotate all secrets and credentials on affected machines and check network logs for connections to the indicators of compromise listed below.