Any developer listen up, Axio has been compromised.

StepSecurity CRITICAL VULNERABILITY MARCH 31, 2026 Back to Supply Chain Attack axios Compromised on npm. Malicious Versions Drop Remote Access Trojan HiJacked maintainer account used to publish poisoned releases including 1.14.1 and 0.30.4 with a hidden dependency that drops a cross platform RAT dropper C2:shok.com:8000 Account Takeover:jasonayman News axios Compromised on npm Versions Drop Remote Access Trojan Hijacked maintainer account used to publish poisoned releases including 1.14.1 and 0.30.4 with a hidden dependency that drops a cross platform RAT. We are actively investigating and will update this post with a full technical analysis. Ashish Kurmi March 30, 2026 Table of Contents Attack Timeline How the Attack Works Platform-Specific Payload The version spoofing trick in package.md The anti-forensics stub (package.md) deserves particular attention. After setup.js runs, it renames package.md to package.json. The stub reports version 4.2.0 - not 4.2.1: // Contents of package.md (the clean { "name": "plain-crypto-js", "version": "4.2.0", "description": "JavaScript lib "license": "MIT", "author": { "name": "Evan Vos "homepage": "http://github.co "repository": { "type": "g "main": "index.js", // No "scripts" key "dependencies": {} } This creates a secondary deception layer. After infection, running npm list in the project dire will report plain-crypto-js@4.2.0 - because npm list reads the version field from the Impact: These versions contained a trojanized dependency (plain-crypto-js@4.2.1) that deployed a Remote Access Trojan (RAT) targeting Windows, macOS, and Linux. Action Required: If you installed axios between roughly 00:00 and 03:30 UTC on March 31, 2026, assume your system is compromised. Remediation: Immediately uninstall the affected versions. Use npm install --ignore-scripts to prevent the malicious script from running during installation. Downgrade to safe versions: 1.14.0, 1.13.3. Rotate any credentials, API keys, or that were present on the affected machine. Techzine Global +3 Normal Usage In normal circumstances (using ^1.14.0 or later), axios is installed via npm: