Supply Chain Compromise Impacts Axios Node Package Manager
Axios npm packages compromised with malicious dependency delivering remote access trojan.
On March 31, 2026, two versions of the Axios npm package (axios@1.14.1 and axios@0.30.4) were compromised with a malicious dependency plain-crypto-js@4.2.1 that downloads multi-stage payloads including a remote access trojan from attacker infrastructure. CISA released guidance urging organizations to downgrade affected versions, rotate credentials, monitor for C2 connections to Sfrclak[.]com, and implement preventive measures such as MFA, script execution restrictions, and minimum release-age policies. The compromise affects JavaScript developers across Node.js and browser environments who installed the tainted packages.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers successfully injected malicious code into two versions of the widely-used Axios npm package by introducing a compromised dependency (plain-crypto-js@4.2.1) that delivered remote access trojans to developers' systems. This supply chain attack demonstrates how a single compromised package can impact thousands of JavaScript applications across Node.js and browser environments. The incident highlights the critical need for package verification, dependency monitoring, and secure development practices. Organizations must treat third-party dependencies as potential attack vectors and implement controls to detect and prevent malicious code injection.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — Sfrclak[.]com
- malware — plain-crypto-js@4.2.1
- malware — remote access trojan