Strix Logo
Strix
Mar 31, 2026

Axios npm Supply Chain Compromise — 1.14.1/0.30.4

@npmjs @GHSecurityLab there is an active supply chain attack on axios@1.14.1 which pulls in a malicious package published today - plain-crypto-js@4.2.1 - someone took over a maintainer account for Axios Skip to content Search Gists All gistsBack to GitHub Sign inSign up Instantly share code, notes, and snippets. joe-desimone/axios_compromise.md Secret Created 53 minutes ago CodeRevisions1 Clone this repository at &lt;script src=&quot;https://gist.github.com/joe-desimone/36061dabd2bc2513705e0d083a9673e7.js&quot;&gt;&lt;/script&gt; axios_compromise.md Summary The npm maintainer account jasonsaayman on the axios package has been compromised. The attacker has published malicious versions of axios and a new typosquat payload package plain-crypto-js. Two dist-tags currently point to compromised versions: latest -> 1.14.1 and legacy -> 0.30.4. Every npm install axios pulls the backdoored package. Immediate actions requested Unpublish axios@1.14.1 and axios@0.30.4 Unpublish plain-crypto-js (all versions: 4.2.0, 4.2.1) Lock the jasonsaayman npm account — credentials are compromised Restore the latest dist-tag to axios@1.14.0 (the last legitimate release) Restore the legacy dist-tag to axios@0.30.3 (the last legitimate 0.30.x release) Affected packages PackageVersionStatusaxios1.14.1Malicious — currently tagged latestaxios0.30.4Malicious — currently tagged legacyplain-crypto-js4.2.0, 4.2.1Malicious — payload delivery vehicle (postinstall backdoor)axios1.14.0Last known legitimate release (1.x line)axios0.30.3Last known legitimate release (0.30.x line) Evidence of account compromise The jasonsaayman maintainer email was changed from the legitimate jasonsaayman@gmail.com (visible on axios@1.14.0 and all prior versions) to ifstap@proton.me (visible on axios@1.14.1 and axios@0.30.4). axios@1.14.0 (legitimate — last good 1.x release): Published: 2026-03-27T19:01:40Z Published by: GitHub Actions via OIDC trusted publisher _npmUser: {"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:9061ef30-3132-49f4-b28c-9338d192a1a9"}} Has SLSA provenance attestations Dependencies: form-data, proxy-from-env, follow-redirects (no plain-crypto-js) axios@0.30.3 (legitimate — last good 0.30.x release): Published: 2026-02-18T17:19:20Z Published by: jasonsaayman / jasonsaayman@gmail.com Dependencies: form-data, proxy-from-env, follow-redirects (no plain-crypto-js) axios@1.14.1 (compromised): Published: 2026-03-31T00:21:58Z Published by: jasonsaayman / ifstap@proton.me — direct CLI publish, no OIDC, no provenance attestations Dependencies include plain-crypto-js@^4.2.1 (the only change from 1.14.0's dependency list) axios@0.30.4 (compromised): Published: 2026-03-31T01:00:57Z (~39 minutes after 1.14.1) Published by: jasonsaayman / ifstap@proton.me The ONLY difference from the legitimate 0.30.3 is: version bump and addition of plain-crypto-js@^4.2.1 to dependencies (all other files including bin/ssl_hotfix.js are byte-identical to 0.30.3) Technical analysis of the payload Delivery chain axios@1.14.1 or axios@0.30.4 declares plain-crypto-js@^4.2.1 as a dependency plain-crypto-js has "postinstall": "node setup.js" in its package.json setup.js is a heavily obfuscated multi-platform backdoor installer Decoded payload behavior (setup.js) The obfuscation uses XOR + base64 with the key "OrDeR_7077". Decoded strings reveal: C2 server: http://sfrclak.com:8000/ Campaign ID: 6202033 On macOS (darwin): Downloads a binary via curl to /Library/Caches/com.apple.act.mond (disguised as an Apple system daemon) POST body: packages.npm.org/product0 Makes executable (chmod 770) and runs in background via /bin/zsh Launched through osascript (AppleScript) for process-tree evasion On Windows (win32): Copies PowerShell to %PROGRAMDATA%\wt.exe (masquerading as Windows Terminal) Creates a VBScript (.vbs) that: Downloads a .ps1 payload from the C2 Runs it hidden: wt.exe -w hidden -ep bypass -file <payload>.ps1 Deletes the .ps1 after execution Launches VBScript silently via cscript //nologo, then deletes it On Linux (fallback): Downloads curl -o /tmp/ld.py from the C2 Runs python3 /tmp/ld.py in background via nohup Anti-forensics: setup.js deletes itself after execution Renames package.md to package.json, overwriting the malicious package.json (with the postinstall hook) with a clean copy, so post-incident inspection of node_modules/plain-crypto-js/package.json will not show the trigger Decoded string table from setup.js stq[0]: "child_process" stq[1]: "os" stq[2]: "fs" stq[3]: "http://sfrclak.com:8000/" stq[5]: "win32" stq[6]: "darwin" stq[7]: VBScript payload (Windows attack vector) stq[8]: "cscript \"LOCAL_PATH\" //nologo && del \"LOCAL_PATH\" /f" stq[9]: AppleScript payload (macOS attack vector) stq[10]: "nohup osascript \"LOCAL_PATH\" > /dev/null 2>&1 &" stq[12]: Linux curl + python3 payload stq[13]: "package.json" stq[14]: "package.md" stq[15]: ".exe" stq[16]: ".ps1" stq[17]: ".vbs" Impact axios is the #4 most downloaded npm package, with approximately 60 million weekly downloads. The compromised version 1.14.1 is currently the latest tag, and 0.30.4 is tagged legacy. Any CI/CD pipeline, developer workstation, or production deployment running npm install with axios as a direct or transitive dependency since 2026-03-31T00:21:58Z may have executed the stage-2 payload. Timeline (all times UTC) TimeEvent2026-02-18T17:19:20Zaxios@0.30.3 published legitimately by jasonsaayman@gmail.com2026-03-27T19:01:40Zaxios@1.14.0 published legitimately via GitHub Actions OIDC2026-03-31 (exact time unknown)plain-crypto-js@4.2.0 and 4.2.1 published (brand-new package, attacker-controlled, first publish date March 30/31, 2026)2026-03-31T00:21:58Zaxios@1.14.1 published by compromised jasonsaayman account with email ifstap@proton.me (becomes latest tag)2026-03-31T01:00:57Zaxios@0.30.4 published by same compromised account (tagged as legacy) Current dist-tags latest: 1.14.1 (COMPROMISED) legacy: 0.30.4 (COMPROMISED) old-version: 0.30.0 (legitimate) next: 1.7.0-beta.2 (legitimate) Recommendations Unpublish axios@1.14.1, axios@0.30.4, and all versions of plain-crypto-js immediately Lock the jasonsaayman npm account pending investigation Restore latest dist-tag to axios@1.14.0 Restore legacy dist-tag to axios@0.30.3 Notify the other axios maintainers (mzabriskie, nickuraltsev, emilyemorehouse) Issue a security advisory for downstream consumers Report sfrclak.com to its registrar/hosting provider for C2 takedown Thank you for your urgent attention. to join this conversation on GitHub. Already have an account? Sign in to comment Footer © 2026 GitHub, Inc. Footer navigation Terms Privacy Security Status Community Docs Contact Manage cookies Do not share my personal information dig deep clone these public repos safetly etc look at commit hisotry everything anaalyze the breach + scope + how

Powered by Strix