Axios NPM supply chain incident
Summary: Cisco Talos is investigating a March 31, 2026 supply chain attack on the official Axios npm package in which two malicious versions, v1.14.1 and v0.30.4, were deployed and available for roughly three hours on a library with as many as 100 million weekly downloads. The packages added a fake runtime dependency, plain-crypto-js, that runs at post-install without user interaction, contacts actor infrastructure at 142[.]11[.]206[.]73 with operating system information, and delivers a platform-specific remote access trojan to Linux, MacOS, or Windows.
What's compelling: The actors exfiltrated credentials and remote management capabilities, so Talos advises treating every credential on any system that pulled the malicious package as compromised and rotating them as quickly as possible - a three-hour window that may already have closed on your build pipeline.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2026-20127
- Related
- Fire Eye Breach Detection Guidance Cyber Risks ·Threat Advisory: NSA SVR Advisory Coverage Cyber Risks ·Inside Key Drift: Analyzing historical UAT-11473 activity on Cisco SD-WAN Cyber Risks · Oct 28, 2026