Supply chain blast: Top npm package backdoored to drop dirty RAT on dev machines

Steven

Supply chain blast: Top npm package backdoored to drop dirty RAT on dev machines

Summary

One of npm’s most-used HTTP clients, Axios, was briefly compromised when attackers hijacked a maintainer’s npm account and published two malicious releases (axios@1.14.1 and axios@0.30.4). Instead of altering Axios’s source, the intruders added a rogue dependency, plain-crypto-js@4.2.1, whose post-install script fetched a second-stage payload and installed a cross-platform remote-access trojan. On macOS it posed as a system daemon, on Windows it used PowerShell, and on Linux it fell back to a Python backdoor. The malicious releases were later removed from the registry, but some developers and CI pipelines had already installed them.

Key Points

  • The compromised maintainer account (user ‘jasonsaayman’) was used to publish malicious versions after the account’s email was swapped to a ProtonMail address.
  • Attackers published via the npm CLI, bypassing the project’s GitHub Actions CI/CD pipeline and expected safeguards.
  • The injected package plain-crypto-js@4.2.1 executed a post-install routine that fetched platform-specific RAT payloads and attempted to erase traces.
  • StepSecurity says the campaign was highly planned: payloads for three OSes were staged in advance and releases were coordinated quickly.
  • Axios averages ~100 million downloads per week, so even a brief compromise can reach a large number of developers and automated systems.

Context and relevance

This attack is part of a broader trend of supply-chain compromises targeting package ecosystems (npm, PyPI, etc.). It exposes how attacker access to a maintainer account can defeat assumptions about CI-enforced safety, and reinforces the need to treat dependencies and publishing credentials as critical assets in security policy.

Why should I read this?

Because this one could quietly own your dev kit. If you use Axios — or run CI that pulls dependencies — check now whether you pulled 1.14.1 or 0.30.4. If you did, assume compromise, rotate credentials, and follow the cleanup steps. It’s nasty, fast and worth the few minutes to verify you’re not infected.

Author style

Punchy: this is a high-impact supply-chain story. Security firm analysis calls it one of the most operationally sophisticated npm attacks on record — read the detail and action the checklist, don’t skim.

Recommended actions

  • Search dependency graphs and CI logs for axios@1.14.1 or axios@0.30.4 and remove any instances immediately.
  • Audit for plain-crypto-js@4.2.1 or unexpected post-install scripts and delete suspicious artefacts.
  • Rotate credentials used by developer tooling and CI; consider rebuilding compromised hosts from scratch.
  • Enable MFA on maintainer and registry accounts and tighten publish controls to prevent direct CLI pushes.

Source

Source: https://go.theregister.com/feed/www.theregister.com/2026/03/31/axios_npm_backdoor_rat/