Published on 16 August 2026
On March 31, 2026, three hours were enough to turn one of the most popular building blocks of modern web development into a weapon. During this window, two manipulated versions of axios were available for download in the npm registry – the central package store for JavaScript software. Anyone who triggered a build, installed an update or ran a continuous integration pipeline (an automated build and test process, CI/CD for short) at that moment may have pulled a cross-platform backdoor onto their machine. No click, no warning, no further action required.
axios is a very widely used programming library that lets applications make network requests. It is embedded in countless websites, web shops and backend services – often without the operators even knowing, because it is included as a so-called transitive dependency (indirectly delivered via another package). That is precisely what makes this incident so dangerous: even those who never knowingly installed axios can be affected.
According to the axios project's official post-incident analysis, an attacker took over the npm account of the lead maintainer – the person primarily responsible for publishing the package – in the course of a targeted social engineering campaign involving malware. Using this hijacked access, the attacker published two malicious releases outside the regular process:
Both versions pulled in an additional dependency: plain-crypto-js@4.2.1. Its configuration file package.json contained a so-called postinstall hook – a script that npm runs automatically after installation. Maintainer Jason Saayman describes it unambiguously in the official post-mortem analysis:
„On March 31, 2026, two malicious versions of axios (1.14.1 and 0.30.4) were published to the npm registry through my compromised account." (Jason Saayman, axios maintainer, 02.04.2026)
„Both versions injected a dependency called `plain-crypto-js@4.2.1` that installed a remote access trojan on macOS, Windows, and Linux." (Jason Saayman, axios maintainer, 02.04.2026)
A Remote Access Trojan (RAT) is a piece of malware that allows an attacker to remotely control the infected system. The axios team removed the malicious versions from npm at 03:15 UTC, with plain-crypto-js following at 03:29 UTC. The delivery window was therefore around three hours.
An important point for context: this is not a classic programming flaw with a regular patch, but a successful supply chain attack on a build artefact that was itself obtained from a trusted source. A standalone CVE identifier (standardised vulnerability number) for the axios incident itself has not been reliably confirmed – this concerns compromised packages that have since been removed.
The process was sophisticated and ran silently in the background. Google Threat Intelligence describes the central trick as follows:
„The threat actor used the `postinstall` hook within the `package.json` file of the malicious dependency to achieve silent execution." (Google Threat Intelligence Group, 31.03.2026)
Specifically, installation automatically launched an obfuscated dropper called setup.js – a small preparatory program that downloads the actual malware. It was obfuscated with XOR and Base64, detected the operating system and downloaded a second stage from http://sfrclak[.]com:8000. Wiz describes the behaviour:
„The malicious package includes a dropper (`setup.js`) that downloads and executes platform-specific second-stage payloads from `sfrclak.com:8000`, and then self-cleans by deleting itself and restoring a clean package.json." (Wiz, 31.03.2026)
The dropper thus attempted to cover its own tracks: it deleted itself and replaced the manipulated package.json with a harmless file. This makes any subsequent inspection considerably more difficult – but it also means that a system that looks clean today does not rule out a past infection.
The second stage that was downloaded goes by the name WAVESHAPER.V2 and works on all three major operating systems:
/Library/Caches/com.apple.act.mond%PROGRAMDATA%\system.bat and the autostart entry (Run key) MicrosoftUpdate/tmp/ld.pyAll variants checked in every 60 seconds via HTTP POST with Base64-encoded JSON to their command-and-control server (C2). Their capabilities: system reconnaissance, listing of files and directories, execution of arbitrary commands and, in some variants, the injection of further programs. The central network indicator is the domain sfrclak[.]com or the IP address 142.11.206.73 on port 8000.
This distinction is crucial so you can assess your situation correctly:
Website visitors are not affected. Simply opening a website in a browser does not trigger the npm postinstall hook. The execution mechanism lay exclusively within the installation process on the development or build host.
Potentially affected are development machines, CI/CD runners, build servers and container image builds if an npm install, npm update, a fresh build or a non-deterministic npx execution with an affected axios version took place there within the window on 31 March 2026 (roughly between 00:21 and 03:29 UTC).
Such hosts are particularly sensitive: they often hold access credentials for cloud services, Git, SSH, deployment and sometimes production data. In the event of a RAT infection, a possible leak of secrets and a compromise of the host must therefore be assumed.
The scale can only be quantified to a limited extent – and all figures should be treated with caution:
Public, verified overall figures for affected companies, individuals or data records are not available.
grep -E "axios@(1\.14\.1|0\.30\.4)|plain-crypto-js" package-lock.json yarn.lock 2>/dev/null
npm ls axios plain-crypto-js --all to display the installed versions and compare them with lockfiles and CI logs. Bear in mind: a clean node_modules tree today does not rule out a historical execution, because the dropper attempted to remove its traces.axios@1.14.1, axios@0.30.4 and plain-crypto-js@4.2.1.sfrclak[.]com, 142.11.206.73 and port 8000, as well as for Node.js child processes during npm installations. Use the IOCs, hashes and YARA rules published by Google.%PROGRAMDATA%\wt.exe, %PROGRAMDATA%\system.bat, Run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate. macOS: /Library/Caches/com.apple.act.mond. Linux: /tmp/ld.py. These indicators are search hints, not by themselves proof of the absence of compromise.Merely upgrading or deleting the package does not remove a possible RAT infection. CISA sums up the urgency:
„CISA urges organizations to implement the following recommendations to detect and remediate a potential compromise." (CISA, 20.04.2026)
axios@1.14.0 for the 1.x path or axios@0.30.3 for the 0.x path. Remove plain-crypto-js from node_modules, update the lockfile, clear caches and rebuild from a clean environment.sfrclak[.]com, 142.11.206.73 and port 8000, and search retrospectively as well as continuously for connections.ignore-scripts=true prevents installation scripts, min-release-age=7 delays the acquisition of very new packages. Test both beforehand for compatibility, as legitimate build steps may be affected.For the future, it is also advisable to inventory transitive dependencies, lock version resolutions, use SBOMs (software bills of materials) and software composition analysis, and apply phishing-resistant multi-factor authentication (MFA) for maintainer and build access. As its own remediation, axios announced an immutable release setup and OIDC publishing (tokenless publishing tied to the CI).
A technical compromise is not automatically a reportable data breach. The incident becomes GDPR-relevant when a compromised development, CI or production host has processed personal data, or when the backdoor may have enabled unauthorised access to it – because a personal data breach also encompasses unauthorised access or unauthorised disclosure.
In this case, the notification obligation under Art. 33(1) GDPR applies: the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, provided the breach is likely to result in more than a low risk. Processors must inform the controller without undue delay under Art. 33(2). Where a high risk is likely, notification of the affected individuals is generally also required under Art. 34; the exceptions must be examined on a case-by-case basis.
In practice, this means: document in a traceable manner which hits there were, how far the RAT could have reached, which types of data were affected, which systems were actually reachable, whether there were exfiltration indicators and which blocking and rotation measures you took. A mere lockfile finding without an executed installation or without any personal data reference is to be assessed differently from a confirmed RAT execution on a CI runner with customer or production access. This is a general assessment, not legal advice for an individual case.
On the fine framework: Art. 83(4)(a) GDPR provides for fines of up to EUR 10 million or up to 2% of worldwide annual turnover for infringements of the obligations under Art. 33 and 34, whichever is higher. As a German comparison case – explicitly not related to this incident – the Berlin data protection authority documents a fine of EUR 60,000 against a software provider for improperly implemented measures for the security of processing. No sanction for the axios case can be derived from this.
The axios incident is a textbook example of why supply chain attacks rank among the most dangerous threats to software: the problem was not your own programming, but a building block that everyone trusted. The damage does not occur among website visitors, but where software is built – on build servers and developer machines full of valuable access credentials.
The decisive question is not „Do I use axios?", but: Did an npm operation take place on my systems within the relevant window on 31 March 2026? If so, investigation, rebuilding and above all the rotation of all secrets are time-critical. If you find only a historical lockfile hint without proof of installation, check caches and CI audit data. And if it is verifiable that no installation operation with the affected versions took place, your risk is low.
OWASP does not list software supply chain failures as a separate Top 10 category in 2025 without reason – the self-replicating npm worm „Shai-Hulud" reached over 500 package versions in 2025 before npm stopped it. Anyone building software today is building on third-party code. That makes it all the more important to secure this supply chain: with locked versions, disabled installation scripts where possible, phishing-resistant MFA for build access and a clear inventory of your dependencies. The three hours of 31 March should be reason to do this homework now – before the next trusted building block becomes a weapon.