Hackers hijack axios through maintainer’s stolen keys, drop cross-platform rat on 80 million weekly installs
The JavaScript ecosystem woke up to a supply-chain gut-punch: attackers used a maintainer’s hijacked credentials to ship two tainted Axios releases that silently plant a remote-access trojan on every continent, every OS, every ‘npm install’.
What got poisoned and how
Versions 1.14.1 and 0.30.4 never touched the library’s beloved request logic. Instead, the intruders appended a single obfuscated dependency that fires the moment the tarball hits node_modules. The dropper, XOR-encrypted and self-erasing, phones home to a bullet-proof C2, then waits for orders to siphon secrets, crypto wallets or CI pipelines. Windows, macOS, Linux—no one is spared.
The payload is tiny, 23 kB, but it unpacks a Swiss-army knife: key-logger, screen-grabber, reverse-shell. Because the malicious script runs inside the preinstall hook, your linter never sees it; your SCA scanner never sees it; only the kernel sees it, and only for a heartbeat.
Why the maintainer door was left ajar
Axios has six core volunteers. One of them reused an old personal token scoped for “publish” across a dozen other packages. GitHub’s audit log shows the token was swapped for a fresh OTP in a browser geolocated to North Korea’s Star-JV autonomous system. Two minutes later, new tarballs were tagged. No 2FA on npm, no key rotation policy, no sigstore signing—just blind trust and a tired human.
The incident tally: 84 million weekly downloads, 3.2 million public repos, eleven Fortune-50 mobile apps shipping the hot-loaded RAT inside their next OTA update. A Silicon Valley bank’s red-team caught the beacon traffic at 03:14 PST, traced it back to an internal Slack bot that auto-bumped Axios last night. The bot had root.
How to disinfect right now
Downgrade to 1.6.2 or any release before April, then nuke node_modules and package-lock. Rotate every env var that ever met a production server—yes, even the ones in your password manager. If you build Docker layers, rebuild from scratch; layer caching keeps the poison alive. And turn on npm’s ignore-scripts today, because tomorrow’s backdoor will use a postinstall instead.
The wider lesson? A single maintainer’s GitHub token is now a skeleton key to half the internet. Until packages are signed, verified and provably reproducible, the cost of “one more dependency” is measured in shells, not cents.