🚨 Axios has been compromised
Malicious Axios versions, a Trojan installed through postinstall, and what to do if your environment was compromised.
Malicious code made its way into the Axios npm package, a classic supply chain attack.
📦 Infected versions:
1.14.10.30.4
⏱️ They were live for only ~2–3 hours, but that was enough to reach CI/CD and production.
If you ran npm install between 00:21 and 03:15 UTC, your environment is considered compromised.
🧩 It was not the axios code itself, but a rogue dependency, plain-crypto-js, that installed a Trojan through postinstall.
🛠 What to do:
- check your lockfile for
axios@1.14.1or0.30.4 - if they were present → treat the environment as compromised (local/CI)
- delete
node_modules+ the lockfile and rebuild the project - urgently rotate ALL secrets (npm, GitHub, AWS, env, etc.)
- check CI/CD (if an install ran there during that window)
- pin versions to safe ones (
1.14.0/0.30.3) - use strictly pinned dependency versions (no floating ranges)
💡 And yes, about dependencies
We often pull in libraries out of habit, even though:
- HTTP → we already have
fetch - basic things can be written in a couple of minutes
- web standards have covered a whole range of use cases for a long time
Every dependency is:
- ⚠️ a potential attack vector
- 📦 someone else’s code in your production environment
- 🔗 a risk of supply chain attacks like this one
Sometimes writing your own is cheaper than dealing with the aftermath.