Axios Supply Chain Attack: What Happened, How We Responded, and What You Should Do Right Now

On March 31, 2026, a supply chain attack compromised the npm package axios, a widely used HTTP client library in the JavaScript ecosystem, following a similar incident involving LiteLLM a week prior. The attack involved publishing a malicious version of axios (1.14.1) that included a new dependency, plain-crypto-js, which did not exist before the attack, enabling a remote access trojan with command-and-control capabilities. This trojan executed a multi-stage attack, including the deployment of platform-specific backdoors, allowing attackers persistent access to compromised systems. The incident was quickly detected by Comet, who responded by auditing repositories, scanning developer machines, and ensuring no production systems were affected, largely thanks to their use of committed lockfiles which prevented automatic resolution to the compromised version. The swift response and preventive measures highlighted the importance of security awareness, fast detection, and robust incident response processes, emphasizing the need for vigilant defenses in the open-source community against such high-value targets.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.