On 31 March 2026 attackers published two malicious versions of axios, the JavaScript HTTP client with over 100 million weekly downloads, from the lead maintainer's npm account. axios 1.14.1 and 0.30.4 added a dependency, plain-crypto-js, whose install script dropped a cross-platform backdoor on Windows, macOS and Linux. The versions were live for about three hours. Google Threat Intelligence Group attributes the attack to UNC1069, a financially motivated North Korea-nexus group. The maintainer's post-mortem says the attacker reached his computer through a targeted social engineering campaign and malware, then used his npm account credentials to publish. Bots made the reach worse. GitGuardian saw Dependabot open the first upgrade on a public repository about five minutes after the release, and found at least 895 public repositories that moved to a malicious version. Some upgrades were merged by bots with no human involved. The project says it is moving to OIDC-based publishing and immutable releases.
Key takeaways
- Malicious axios 1.14.1 and 0.30.4 were published on 31 March 2026 from the lead maintainer's npm account and removed about three hours later. Google attributes the attack to North Korea-nexus UNC1069.
- The attacker used a fake company, a branded Slack workspace and a fake Microsoft Teams error to install malware on the maintainer's computer, then used his npm credentials to publish. Two-factor authentication was on and did not help.
- Automation spread it fast: GitGuardian counted at least 895 public repositories that upgraded to a malicious version, and 50 pull requests merged into a main branch by a bot user without user interaction.
- This was not part of the TeamPCP campaign, though it ran in the same weeks. The axios project confirmed the compromise, and the payload was a backdoor rather than a pure credential stealer.
- The identity lesson: a publishing identity on one person's laptop and a bot that merges updates on its own are both non-human access paths, and attackers will use both.
At a glance
| Organisations | axios open source project (npm package) and the developers, pipelines and repositories that installed 1.14.1 or 0.30.4 |
|---|---|
| When | Social engineering from about mid-March 2026; malicious versions live from 00:21 UTC to about 03:15 UTC on 31 March 2026 |
| Attacker | UNC1069, a North Korea-nexus group, according to Google Threat Intelligence Group and the axios maintainer |
| Entry point | Social engineering of the lead maintainer, a remote access trojan on his computer, then his npm account credentials |
| Identities abused | The maintainer's npm publishing account; automated dependency bots (Dependabot, Renovate) and auto-merge workflows that pulled the release into codebases |
| Impact | Backdoor installed on systems that ran a fresh install in the window; at least 895 public repositories upgraded, according to GitGuardian |
| Category | NHI. Incident class: confirmed NHI breach (package publishing identity hijacked and abused; bot identities spread the release) |
What happened
About two weeks before the attack, the lead axios maintainer, Jason Saayman, was approached by people posing as the founder of a real company. The Hacker News reports, citing his post-mortem, that they invited him to a branded Slack workspace and then to a Microsoft Teams call. There, a fake error said something on his system was out of date, and the "update" he ran was a remote access trojan. "Everything was extremely well coordinated, looked legit, and was done in a professional manner," he said. The post-mortem states: "The attacker gained access to the lead maintainer's PC through a targeted social engineering campaign and RAT malware." That gave the attacker his npm account credentials. Google's report adds that the account's email address was changed to one the attacker controlled.
Datadog Security Labs reconstructed the release. plain-crypto-js 4.2.1, with a malicious postinstall script, was published at 23:59 UTC on 30 March. axios 1.14.1, tagged latest, followed at 00:21 UTC on 31 March, and 0.30.4 at 01:00 UTC. The install script fetched a platform-specific backdoor, which Google tracks as WAVESHAPER.V2, then deleted itself to hide its tracks. StepSecurity reported the compromise in an issue at 02:19 UTC, but the attacker deleted it using the hijacked account. A collaborator contacted npm, which removed the versions and revoked the package's tokens. In the hours after, the maintainer said 2FA had been enabled and that the 1.x line used OIDC trusted publishing while 0.x still used a long-lived npm token, which he revoked. How the attacker published, whether through the account session, password and 2FA, a recovery code or a token, has not been confirmed.
GitGuardian then looked at how far the release travelled. It saw the first package.json change on a public repository, pushed by Dependabot, about five minutes after the upload. It counted at least 895 public repositories that upgraded axios to a malicious version. Of the pull requests it could examine, 95 were merged into a main branch, 50 of them by a bot user without user interaction. GitGuardian wrote: "Dependabot and Renovate pull requests carry an implicit trust that human-authored pull requests do not."
Timeline
| Date | Event |
|---|---|
| March 2026 | A targeted social engineering campaign against the lead axios maintainer begins about two weeks before the attack. |
| 30 March 2026 | plain-crypto-js 4.2.0 is published, followed by malicious 4.2.1 at 23:59 UTC. |
| 31 March 2026 | Malicious axios 1.14.1 (00:21 UTC) and 0.30.4 (01:00 UTC) are published; Dependabot opens upgrades within minutes. |
| 31 March 2026 | The versions are removed after about three hours; Datadog and Google publish analyses and Google attributes the attack to UNC1069. |
| 3 April 2026 | The maintainer's post-mortem confirming social engineering is reported by The Hacker News and Techzine. |
| 10 April 2026 | GitGuardian publishes its analysis of how Dependabot and Renovate delivered the malicious release. |
How it happened: the identity attack path
- A person targeted to reach a machine identity. The attackers social engineered the maintainer to plant a remote access trojan on the computer where his npm access lived.
- The publishing identity taken over. With his npm account credentials, the attacker published new versions and changed the account's email address. 2FA did not stop it once the machine was controlled.
- A trusted name carries the payload. The new versions added a malicious dependency, so the axios code itself looked normal while the install script delivered the backdoor.
- Bots pull it in automatically. Dependabot and Renovate proposed the upgrade within minutes, and auto-merge workflows merged some without review.
- Install equals execution. Every fresh install in the window, on developer machines and CI runners, ran the backdoor with that environment's access.
Impact
- Confirmed: two malicious axios releases published from the maintainer's account and live for about three hours, according to the post-mortem and Datadog.
- Measured spread: at least 895 public repositories upgraded to a malicious version, and 50 pull requests merged into a main branch by a bot without user interaction, according to GitGuardian. Private repositories and pipelines are not counted.
- Potential: a backdoor giving remote command execution on any machine that installed the versions, with access to its tokens, sessions and cloud credentials. Datadog found bugs that stopped the Linux and Windows payloads working as intended.
- Wider: Google warns that hundreds of thousands of stolen secrets could be circulating from the recent wave of supply chain attacks, including this one.
What this means for NHI governance
The axios attack began with a human, but what the attackers wanted was a machine identity: the right to publish a package installed more than 100 million times a week. That right sat on one person's computer, so compromising the computer was enough. The maintainer's response points to the fix. Publishing should go through OIDC trusted publishing from a protected CI workflow, with immutable releases, so no stored token or personal session can push a release on its own. As one contributor noted, npm cannot yet enforce OIDC-only publishing at the registry level.
The second identity problem is the bots on the receiving end. Dependabot, Renovate and auto-merge workflows are non-human identities with write access to codebases. When they merge whatever is newest, they turn a three-hour window into production code. GitGuardian's advice is a cooldown of several days before new versions are adopted. See our CI/CD Pipeline Identity Security Guide and Service Account Security Guide.
The social engineering itself, fake founders, cloned workspaces and fake meeting errors, is covered in our Deepfake and AI Impersonation Guide.
Recommendations
- Remove the affected versions and rotate. Pin axios to 1.14.0 or 0.30.3, delete
node_modules/plain-crypto-js, and rotate every secret on machines and CI runners that installed in the window. See our Leaked Credential Response Playbook. - Add a cooldown to dependency bots. Configure Dependabot's cooldown and Renovate's minimum release age so new versions wait several days before they are proposed.
- Stop bots merging on their own. Require human review for dependency updates on production branches, or at least for new major dependencies and install scripts. See our Service Account Security Guide.
- Move publishing to trusted publishing. Publish only from a protected CI workflow with OIDC, and retire long-lived npm tokens. See our CI/CD Pipeline Identity Security Guide.
- Monitor for unexpected releases. Alert on any publish that does not match a tagged CI release, since the post-mortem admits there was no automated way to detect one.
Frequently asked questions
Which axios versions were compromised?
axios 1.14.1 and 0.30.4, published on 31 March 2026 and removed about three hours later. Both pulled in plain-crypto-js 4.2.1, which installed the backdoor. Safe versions are 1.14.0 and 0.30.3 or earlier.
Who was behind the axios attack?
Google Threat Intelligence Group attributes it to UNC1069, a financially motivated North Korea-nexus threat actor active since 2018, and the maintainer's post-mortem says the same. It is a separate campaign from TeamPCP's attacks on Trivy, LiteLLM and others in the same period.
What does Dependabot have to do with the axios compromise?
Dependabot did nothing wrong in itself, but it proposed the malicious upgrade within minutes, and some repositories merged its pull requests automatically. GitGuardian found 50 bot-merged pull requests, which is why it recommends a cooldown before adopting new releases.
Related NHI Mgmt Group resources
Fake Dependabot Commits 2023 · Mastra npm Supply Chain Attack 2026 · Trivy supply chain attack 2026 · CI/CD Pipeline Identity Security Guide · Deepfake and AI Impersonation Guide
How NHI Mgmt Group can help
Publishing rights and dependency bots are non-human identities that most teams never review. We help organisations find them, move publishing to short-lived credentials and put guardrails on automation that can change production code. See our NHI and AI agent security training.
References
- axios (Jason Saayman): Post mortem of the axios npm supply chain compromise, GitHub issue #10636 (31 March 2026)
- Datadog Security Labs: Compromised axios npm package delivers cross-platform RAT (31 March 2026)
- Google Threat Intelligence Group: North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack (31 March 2026)
- The Hacker News: UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack (3 April 2026)
- Techzine: Axios supply chain attack victim posts postmortem to prevent a repeat (3 April 2026)
- GitGuardian: Renovate & Dependabot: The New Malware Delivery System (10 April 2026)