The Axios npm Attack: How 100 Million Downloads Became a Backdoor

If you write JavaScript, you almost certainly use axios. It is the go-to HTTP library for everything from small React apps to large Node.js backends, pulling in over 100 million downloads every week. On the night of March 31, 2026, someone turned it into a weapon.

The group behind the attack is tracked as UNC1069, a financially motivated crew with ties to North Korea that has been active since 2018. They obtained a long-lived npm token belonging to the main axios maintainer, jasonsaayman, swapped the account email to a Proton Mail address they controlled, then quietly pushed two poisoned releases in a 39-minute window before anyone spotted what was happening.

What set this apart from a typical hijack was the preparation. The attackers staged everything 18 hours in advance, built separate payloads for Windows, macOS, and Linux, and made the malware delete itself after running. It wiped the dropper, swapped in a clean-looking package.json, and left almost no trace on disk.

How It Unfolded: The Attack Timeline

The Full Attack Chain

"This was not opportunistic. The malicious dependency was staged 18 hours in advance. Three separate payloads were pre-built for three operating systems. Both release branches were hit within 39 minutes. Every trace was designed to self-destruct."

Step-by-Step: How to Check if You Were Affected

The first thing to do is find out whether you were running one of the compromised versions and whether the dropper ever had a chance to run.

# Check what version your project is using
npm list axios

# Check globally installed packages too
npm list -g axios

# Scan your whole machine for any axios installs (Mac/Linux)
find / -path "*/node_modules/axios/package.json" 2>/dev/null | while read f; do
  version=$(grep '"version"' "$f" | head -1)
  echo "$f -> $version"
done

# The most important check: search lockfile history for the phantom dependency
git log -p -- package-lock.json | grep "plain-crypto-js"
# If this returns anything at all, keep reading carefully

Real axios has exactly three dependencies: follow-redirects, form-data, and proxy-from-env. If you see plain-crypto-js anywhere in your lockfile history, that is not ambiguous. That is tampering.

How to Fix It: Remediation Steps

1. Block the C2 domains at your firewall first. Do this before anything else. Block sfrclak.com and 142.11.206.73:8000. As long as those are reachable, any already-infected machine is still under attacker control.
2. Downgrade axios right now. Run npm install axios@1.8.3 or npm install axios@0.30.3 for legacy projects. Commit the updated lockfile.
3. Get plain-crypto-js out of there. Remove it from node_modules and make sure it is gone from your lockfile.
4. Found RAT artifacts? Treat the machine as fully owned. Rotate everything: npm tokens, SSH keys, API keys, database passwords, cloud credentials. All of it.
5. Check what got committed while it had access. Look for unexpected changes to pipeline configs, CI secrets, or any new tokens issued during the window.

How to Harden npm So This Cannot Happen Again

# Drop these into your .npmrc and commit it
save-exact=true
ignore-scripts=true
min-release-age=3

# In CI, always use npm ci instead of npm install
npm ci   # Installs exactly what is in the lockfile, no surprises

# Add these defaults to your base Docker image too
RUN echo "ignore-scripts=true" >> /root/.npmrc && \
    echo "min-release-age=3"   >> /root/.npmrc && \
    echo "save-exact=true"     >> /root/.npmrc

Indicators of Compromise (IOCs)

Use these to search your logs, firewall records, and endpoint detection tools for signs of infection.

What This Means for Your Business

This is not a vulnerability in the traditional sense where you patch a library and move on. The axios package itself was fine. The maintainer's account was the weak point, and through that single credential attackers reached every developer and CI system that ran npm install during a six-hour window. With 100 million downloads per week, the potential blast radius was enormous.

Huntress confirmed over 100 compromised hosts in the first 24 hours alone. Because the malware deletes itself, the real number is almost certainly higher. Google's Threat Intelligence Group attributes this to UNC1069, a North Korea-linked group that is primarily after money, which means stolen credentials and intellectual property are the most likely targets.

Frequently Asked Questions

Is axios safe to use now?

Yes. The compromised versions have been removed from npm. As long as you are on axios@1.8.3 or axios@0.30.3, you are safe.

What is the WAVESHAPER.V2 RAT?

WAVESHAPER.V2 is a remote access trojan deployed by the attackers after the SILKBELL dropper runs. It supports full remote code execution, file access, OS command execution, process injection, and two-way encrypted communication with the C2 server at sfrclak.com. It was built separately for Windows, macOS, and Linux.

Would using npm ci have prevented this?

Not on its own, because npm ci still runs postinstall hooks. However, it installs from the lockfile exactly, so if your lockfile was committed before the poisoned versions were published, it would have protected you. The combination of npm ci plus ignore-scripts=true would have fully blocked the attack.

How did Socket.dev catch this in 6 minutes?

Socket.dev uses behavioral analysis on package publish events rather than waiting for CVE reports. It looks at what code a package actually does: does it make outbound network connections? Does it modify system files? Does it obfuscate itself? Those signals fired immediately when plain-crypto-js hit npm. This is why behavioral supply chain monitoring is more effective than CVE-based scanning for this class of attack.

"The real axios has only three dependencies. The addition of plain-crypto-js is unambiguous tampering. When npm processes this vendored axios, it installs plain-crypto-js and triggers the same malicious postinstall chain."

Sources

NetworkChuck · theNetworkChuck/axios-attack-guide on GitHub · Google Threat Intelligence Group (GTIG) · Socket.dev Security Research · Huntress Labs · StepSecurity · Unit 42 by Palo Alto Networks · The Hacker News · Cyber Security Agency of Singapore