A newly discovered software supply chain attack targeting the npm ecosystem briefly compromised one of the most widely used JavaScript libraries in the world.
With initial reporting by researchers at StepSecurity, the incident involved unauthorized publications of the popular HTTP client axios, published to npm and which sees over 300 million weekly downloads.
Between March 30-31, 2026, attackers hijacked an npm publishing account associated with an axios maintainer and released two malicious versions of the package:
axios@1.14.1 (published at 00:21 UTC, March 31, 2026)
axios@0.30.4 (published at 01:00 UTC, March 31, 2026)
Sonatype tracked both packages as sonatype-2026-001623.
Notably, neither version contained malicious code directly. Instead, both introduced a hidden dependency on a newly published package:
plain-crypto-js@4.2.1 (published at 23:59 UTC, March 30, 2026), tracked as sonatype-2026-001622
The naming and timing of this package suggest it was intentionally published to resemble a legitimate cryptography library, likely to confuse or deter researchers during our initial analysis.
Sonatype detected and flagged the packages as malicious within minutes, at 01:04 UTC on March 31, 2026. For organizations using Sonatype's automated defenses, this rapid detection meant automatic protection, blocking downloads of the malicious components before they could reach developer environments.
npm has since removed the malicious axios versions and replaced plain-crypto-js with a security-holder stub.
Axios is one of the most widely used HTTP client libraries in the JavaScript ecosystem. By compromising axios, attackers gained:
Immediate access to a massive developer install base.
High trust due to axios's reputation and ubiquity.
Automatic execution via dependency installation.
Because npm automatically installs and executes life cycle scripts of dependencies, simply installing the affected axios versions triggered the malicious payload. Each time either malicious axios version was installed, npm automatically pulled in plain-crypto-js, ensuring consistent delivery of the payload across environments.
This incident demonstrates how a compromised Axios version can introduce risk without changing the core library itself, relying instead on a malicious dependency.
The malicious dependencies were not isolated to axios alone. As part of a secondary expansion of the attack, Sonatype researchers observed the same compromise associated with OpenClaw packages, indicating broader propagation beyond the initial axios compromise.
Affected packages include:
@qqbrowser/openclaw-qbot@0.0.130
@shadanai/openclaw@2026.3.28-2
@shadanai/openclaw@2026.3.28-3
@shadanai/openclaw@2026.3.31-1
@shadanai/openclaw@2026.3.31-2
This indicates the attacker's technique could propagate beyond a single high-profile package into broader dependencies.
"Attackers have figured out they don't need to compromise the code people trust if they can compromise the trust around it," said Ilkka Turunen, Sonatype Field CTO. "In this case, the malicious capability was introduced through a staged dependency and designed to erase its own tracks, which made the attack harder to spot and slower to understand. That's not just malware — it shows a more deliberate and mature playbook."
The attack leveraged a common but highly effective software supply chain technique of introducing a malicious transitive dependency into a trusted package.
The plain-crypto-js@4.2.1 package functioned as a heavily obfuscated, cross-platform loader. Its behavior includes:
Executing automatically via npm's postinstall life cycle hook.
Using layered decoding routines (base64 + XOR) to dynamically reconstruct hidden strings, including module names, commands, file paths, and a remote endpoint.
Fingerprinting the host OS (Windows, MacOS, Linux).
Fetching a secondary payload from a command-and-control (C2) server.
Writing OS-specific launcher scripts (AppleScript on MacOS, PowerShell/VBS on Windows, Python on Linux) into temporary directories.
Executing system-level commands to download and run the retrieved payload in a hidden or background context.
The dropper ultimately delivered a remote access trojan (RAT), enabling attackers to establish backdoor access to compromised systems.
To evade detection and hinder forensic analysis, the package:
Executes payloads indirectly through generated scripts, rather than inline commands.
Deleted its original malicious artifacts after execution.
Removes and renames package metadata files (e.g., replacing package.json) to mask its presence or restore a benign appearance.
Obfuscates all meaningful strings and logic using custom transformations to resist static inspection.
The result was a silent compromise of the host system immediately upon installation.
This attack enabled unauthorized remote access to affected systems. Any environment that installed the malicious packages should be considered potentially compromised.
Because the payload executed during installation:
CI/CD pipelines may have been affected.
Developer workstations could be backdoored.
Secrets and credentials may have been exposed.
"What makes this incident important is how little visible change was needed to create real downstream risk," said Turunen. "When a widely trusted package can be turned into a delivery path like this, the issue is bigger than package hygiene. It's a trust problem in the software supply chain, and it's why organizations need security controls that look at what’s actually being installed, not just what appears safe at first glance."
If you suspect exposure, take the following steps immediately:
Remove affected packages: Uninstall axios@1.14.1, axios@0.30.4, and plain-crypto-js@4.2.1.
Audit your environment: Review dependency trees and lockfiles. Identify any systems that installed these versions.
Assume compromise: Rotate credentials and API keys. Rebuild affected systems from a clean state.
Verify dependencies: Ensure only trusted, uncompromised versions are in use.
Block malicious components: Use repository controls to prevent reintroduction.
This incident follows a growing trend of attackers targeting:
Transitive dependency chains.
Rather than inserting obvious malicious code into well-known libraries, attackers increasingly rely on indirect dependency injection, making detection more difficult and increasing blast radius.
As this Axios version incident shows, attackers can introduce significant risk through small, indirect changes that are easy to miss in dependency trees.
Recent incidents, including malicious npm packages and PyPI credential stealers, highlight how quickly these attacks are evolving.
Incidents like the axios compromise highlight how quickly malicious code can be introduced into even the most widely trusted open source packages.
Protections such as Sonatype Repository Firewall automatically prevent known malicious dependencies from being downloaded, effectively neutralizing attacks like this even when compromised package versions are requested.
In parallel, Sonatype Guide provides developers with real-time intelligence and context on open source packages, helping teams identify and avoid malicious or high-risk dependencies before they enter the software supply chain.
Together, these capabilities help organizations reduce exposure to fast-moving software supply chain attacks and make safer dependency decisions at scale.