Hackers hijacked the npm account of Axios lead maintainer jasonsaayman Tuesday to publish malicious versions of the popular JavaScript library. Versions 1.14.1 and 0.30.4 injected a hidden dependency that deploys a cross-platform remote access trojan (RAT). The npm registry removed the packages within three hours. Anyone who ran npm install or update during the window of 00:21 to 03:15 UTC is likely compromised.
- Hackers hijacked the npm account of Axios maintainer jasonsaayman to publish malicious versions 1.14.1 and 0.30.4 on Tuesday.
- The compromised window lasted three hours, potentially affecting a portion of the 100 million weekly downloads recorded by the Axios library.
- Poisoned packages install a remote access trojan via the plain-crypto-js dependency, forcing developers to rotate all SSH keys and cloud credentials.
Hijacked Credentials and Postinstall Payloads
Attackers compromised jasonsaayman’s account and changed the registered email to ifstap@proton.me. They bypassed the project’s GitHub Actions CI/CD to manually publish the poisoned versions. The attack added a single hidden dependency: plain-crypto-js@4.2.1.
A postinstall script in the malicious package executes automatically during installation. The script contacts a command-and-control server to download platform-specific payloads for Windows and macOS, along with Linux. Resulting malware grants attackers arbitrary code execution capability. Socket.dev and StepSecurity confirmed the RAT targets SSH keys, API tokens, and cloud access credentials.
Axios sees 80 million to 100 million weekly downloads. Millions of production systems in fintech and crypto platforms rely on the library for API calls. Projects using caret ranges in their package.json files may have auto-updated to the malicious versions.
Expert Warning and Mitigation
Feross Aboukhadijeh, founder of security firm Socket, urged developers to take immediate action following the discovery. “npm has removed the malicious versions,” Aboukhadijeh posted on X. “If you installed either before takedown, assume compromise. Rotate credentials.”
Genuine News Deserves Honest Attention.
High-conviction projects require an intelligent audience. Connect with readers who value sharp reporting.
👉 Submit Your PRSecurity experts recommend rotating all SSH keys, database passwords, and cloud tokens. Access logs should be audited for unusual data exfiltration or privilege changes. node_modules should be checked for plain-crypto-js.
Registry officials at npm have suspended the compromised account and deprecated the malicious versions. The registry has signaled plans for mandatory two-factor authentication for maintainers of high-impact packages starting in the second quarter of 2026.
Chain Street’s Take
The Axios breach illustrates the fragility of open-source infrastructure. Attackers no longer need to find a zero-day vulnerability in Axios source code: they only need to compromise the credentials of a single volunteer maintainer.
Dependency hygiene is no longer an elective practice for enterprise developers. Proactive pinning of versions and the use of automated scanning tools are now requirements for production security. If you installed the affected versions today, the machine is no longer yours. Rotate everything.
Activate Intelligence Layer
Institutional-grade structural analysis for this article.
