The Axios repository was attacked by a supply chain hack, with hackers using stolen npm tokens to implant a remote trojan, affecting approximately 80% of cloud environments.

According to ChainCatcher, attackers stole the npm access token of the lead maintainer of Axios, the most popular HTTP client library for JavaScript, and used it to release two malicious versions (axios@1.14.1 and axios@0.3.4) containing cross-platform remote access trojans (RATs), targeting macOS, Windows, and Linux systems. The malicious packages were removed after surviving on the npm registry for approximately 3 hours. According to security firm Wiz, Axios is downloaded over 100 million times weekly and exists in approximately 80% of cloud and code environments. Security firm Huntress detected the first infections 89 seconds after the malicious packages went live and confirmed at least 135 systems compromised within the exposure window. Notably, the Axios project had previously deployed modern security measures such as the OIDC trusted release mechanism and SLSA source attribution verification, but the attackers completely bypassed these defenses. The investigation revealed that the project retained the traditional, long-term valid NPM_TOKEN while configuring OIDC. When both coexist, npm defaults to using the traditional token, allowing attackers to complete the deployment without breaking through OIDC.