axios Supply Chain Attack — Detection & Remediation

In March 2026, two malicious versions of axios were published to npm:

• - axios@1.14.1 (live ~2h 53m)
• INLINECODE1 (live ~2h 15m)

Both injected a fake dependency plain-crypto-js@4.2.1 that ran a postinstall script deploying a cross-platform remote access trojan (RAT). The malware then deleted itself and replaced its own package.json with a clean decoy to evade detection.

Safe versions: axios@1.14.0 (1.x users) · axios@0.30.3 (0.x users)

Step 1 — Check if the project is affected

Run these checks in the project directory:

CODEBLOCK0

If plain-crypto-js/ exists in node_modules, the dropper executed. The npm list version reported may show 4.2.0 (not 4.2.1) due to the anti-forensics swap — the directory presence is the reliable signal.

Step 2 — Check for RAT artifacts on the system

CODEBLOCK1

On Windows, %PROGRAMDATA%\wt.exe is a persistent copy of PowerShell left behind — it survives package removal and reboots.

Step 3 — Check CI/CD pipeline logs

Search CI run logs for any npm install or npm ci that may have pulled the malicious versions during the window 2026-03-31 00:21 UTC – 2026-03-31 03:15 UTC. Any pipeline run in that window that installed axios should be treated as compromised.

Reading the results

Remediation

If no compromise evidence found (precautionary cleanup)

CODEBLOCK2

If compromise is confirmed (RAT artifact found or dropper ran)

Do NOT attempt to clean in place. The system must be treated as fully compromised.

1. 1. Rebuild from a known-good state — do not trust the affected machine
2. Rotate all credentials accessible at install time:

1. 3. Audit CI/CD — for every pipeline run that installed the malicious version, rotate all secrets that were in scope during that run

1. 4. Block the C2 domain (as a precaution on any potentially exposed network):

   # Linux/macOS — /etc/hosts
   echo "0.0.0.0 sfrclak.com" | sudo tee -a /etc/hosts

   # Linux firewall
   sudo iptables -A OUTPUT -d 142.11.206.73 -j DROP
   

Going forward — prevention

CODEBLOCK4

Add to package.json to prevent accidental upgrade to malicious range:
CODEBLOCK5

Consider tools like StepSecurity Harden-Runner for CI/CD network egress monitoring.

Indicators of Compromise (IOC Reference)

Output format

When running a check, produce a structured report:

CODEBLOCK6