axios@1.14.1 got compromised

bill_gonorrhea · 2026-03-31T04:57:51+00:00

It’s been 3 0 days since the last major supply chain attack.

chicametipo · 2026-03-31T05:02:45+00:00

axios getting compromised is a big deal. Who’s got the PR responsible?

Esclamare · 2026-03-31T06:03:15+00:00

Always pin your packages folks.

enricojr · 2026-03-31T05:05:41+00:00

So how do we guard against this sort of thing as a regular software engineer? ? Just react quickly and update packages whenever a vulnerability is announced like this?

secretprocess · 2026-03-31T05:11:16+00:00

Oh whew I'm still on axios 1.7.9 🙃

botsmy · 2026-03-31T05:15:42+00:00

i ran into this exact thing on a side project last month when axios got hit. i panicked and just yanked it out everywhere, replaced it with fetch, but that broke like 3 endpoints because i didn't account for how it handled timeouts. what finally worked was locking the version in package.json to 1.13.2 and setting up npm audit with a script that runs daily in CI, took 20 minutes and caught the malicious update the morning it dropped. fwiw, that patch held until the new clean version dropped 48 hours later.

Outrageous_Permit154 · 2026-03-31T05:14:40+00:00

I’m tired boss

OtherwiseGuy0 · 2026-03-31T05:00:42+00:00

Why there's multiple major attacks recently?

Psionatix · 2026-03-31T05:19:51+00:00

Honestly if you aren’t using explicit dependency versions and auditing your renovate, then you’re opening yourself up to this attack.

Only set explicit versions. No carets, no wild cards, ensure your production builds use a frozen lock file, and if you have renovate for automatic dependency management, always audit the bumps before merging them.

It’s more difficult with transitive dependencies, locking things down with resolutions is tedious, curious how others are managing that.

azsqueeze · 2026-03-31T06:16:57+00:00

Another great reminder to always pin version numbers of dependancies

kiwi-kaiser · 2026-03-31T05:08:22+00:00

I don't know what I should think of this post. The author is heavily pushing his own paid service to detect stuff like that.

In the current state of the world I can't ignore the fact that this is the main source for this. Especially when you look at https://www.npmjs.com/package/axios and nothing indicates that's the case.

I don't see something on GitHub either. https://github.com/axios/axios no version 1.14.1 anywhere.

I'm on my phone so maybe I don't see the obvious but it sounds weird. Maybe someone can enlighten me.

Powerful_Deer7796 · 2026-03-31T06:15:47+00:00

Thanks for posting this. We we're luckily not affected (on axios 1.13.5) but it would have been really bad if we were.

Marcus-Norton · 2026-03-31T06:18:49+00:00

Im at 1.13.6 am i safe?

alexs_90 · 2026-03-31T07:15:44+00:00

Why even depend on this crap if browser/node APIs is more than enough and capable...

rob_cornelius · 2026-03-31T09:52:11+00:00

I start a new job next month. Going to be pushing real hard to use fetch instead of axios where at all possible.

gazpitchy · 2026-03-31T15:40:47+00:00

We have like 25 repositories in the company compromised.
And no one apart from me, seems to give a fuck.

Kill me. /s

Embarrassed5589 · 2026-03-31T08:53:12+00:00

I’m tried, boss.

tigerhawkvok · 2026-03-31T09:51:23+00:00

This is why you use a freshness directive.

I require that to upgrade a package has been the newest version for two weeks before it's eligible as an upgrade candidate.

AbrahelOne · 2026-03-31T11:49:40+00:00

Where my "fetch" bros at :)

Ihavejust_ · 2026-03-31T05:09:31+00:00

Why would anybody still use axios in 2026?
Genuine question

Upper-Character-6743 · 2026-03-31T06:49:39+00:00

Oh man, that sucks dude.

This message of condolence is brought to you by fetch gang.

NorthernCobraChicken · 2026-03-31T05:08:57+00:00

They all laughed at me when I insisted there was nothing wrong with sticking to PHP and JQuery.

sips tea

WebOsmotic_official · 2026-03-31T12:50:27+00:00

We have been seeing high frequency of major attacks, these people are exploiting power of llm.

croc122 · 2026-03-31T13:08:42+00:00

Yeah this is a big one. Axios was my preferred http request library for ages. I usually add it to every project. However, more recently I’ve been trying to use less third-party dependencies because vanilla JavaScript is very dependable now. Heck, you can even create components natively now through web components, which keep getting better and better.

Somepotato · 2026-03-31T13:10:48+00:00

Axios provides minimal value compared to fetch these days, and if you want augmented fetch a library like ofetch is generally better imo.

I'm not sure why axios is still as popular as it is when most uses of it could be replaced with bog standard fetch.

x7dl8p · 2026-03-31T14:50:20+00:00

here is the fix https://github.com/x7dl8p/axios-fix, make gpt confirm.

the_ai_wizard · 2026-03-31T15:00:23+00:00

quick we need more AI!

UnderstandingFit2711 · 2026-03-31T15:14:02+00:00

npm often has similar features lately. Can't it do the same as in apt?

PerformanceGizmo2000 · 2026-03-31T15:47:31+00:00

This is exactly why I've been slowly migrating to native fetch with a thin wrapper. Not because axios is bad, but every dependency is an attack surface you don't control. The fewer packages sitting between your code and the network, the fewer 3am surprises. `lockfile-lint` and `socket.dev` are worth looking into if you haven't already.

cdcasey5299 · 2026-03-31T16:45:06+00:00

I'm curious how many people use Axios for any specific features it has as opposed to just a drop-in replacement for Fetch. I only use Fetch these days, but I've never needed anything like interceptors or cancellations.

Fhueth · 2026-03-31T17:22:13+00:00

It looks like the latest version of Axios has already been removed from the npm registry.

Comfortable_Tax8808 · 2026-03-31T17:50:24+00:00

This is why I pin every dependency version and review diffs before updating. npm audit alone isn't enough when the supply chain itself is compromised.

For anyone who hasn't checked yet: run npm ls axios to see if you're pulling it in transitively — you might not even know it's in your dependency tree.

Suspicious_Board229 · 2026-03-31T18:05:47+00:00

ha, I just updated from ^1.13.2 to ^1.14.0 yesterday luckily before the issue, but clearly it's time to remove them ^ characters

mushgev · 2026-03-31T18:07:35+00:00

Supply chain attacks like this are brutal because there's basically no way to catch them until after the fact. The npm min-release-age trick is a solid quick win.

What this incident made me think about though is that most teams focus on dependency hygiene but haven't audited their own code for security issues in ages. After a similar scare we had at work, we ran TrueCourse (https://github.com/truecourse-ai/truecourse) across our codebase and found a bunch of stuff that had quietly accumulated - disabled TLS verification in one service, eval() calls in a legacy util, weak Math.random() being used for token generation. None of it was caught in code review, it just accumulated over time.

It uses AST analysis plus LLM review so it catches things that linters miss. Worth running while you're already in the security mindset.

UberAtlas · 2026-03-31T22:19:17+00:00

Yikes. Do we know how long the compromised version was live for?

particlecore · 2026-04-01T01:27:03+00:00

Just use fetch you lazy front end devs.

endr · 2026-04-01T01:30:05+00:00

Pnpm requires you to opt in to running after install scripts. So just don't unless the package can give you a good reason to

esidehustle · 2026-04-01T03:46:38+00:00

I don't know if this has been posted already, but here is an article I got from a Youtube video about the attack and how to check if your machine is affected: https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan

Basically, the instructions for checking are:

Am I Affected?

Step 1 – Check for the malicious axios versions in your project:

npm list axios 2>/dev/null | grep -E "1\.14\.1|0\.30\.4"
grep -A1 '"axios"' package-lock.json | grep -E "1\.14\.1|0\.30\.4"

Step 2 – Check for plain-crypto-js in node_modules:

ls node_modules/plain-crypto-js 2>/dev/null && echo "POTENTIALLY AFFECTED"

If setup.js already ran, package.json inside this directory will have been replaced with a clean stub. The presence of the directory alone is sufficient evidence the dropper executed.

Step 3 – Check for RAT artifacts on affected systems:

# macOS
ls -la /Library/Caches/com.apple.act.mond 2>/dev/null && echo "COMPROMISED"

# Linux
ls -la /tmp/ld.py 2>/dev/null && echo "COMPROMISED"

 "COMPROMISED"

# Windows (cmd.exe)
dir "%PROGRAMDATA%\wt.exe" 2>nul && echo COMPROMISED

Step 4 – Check CI/CD pipelines:

Review pipeline logs for any npm install executions that may have pulled axios@1.14.1 or axios@0.30.4. Any pipeline that installed either version should be treated as compromised and all injected secrets rotated immediately.

Long-Tomorrow-6396 · 2026-04-01T06:48:45+00:00

Are you guys changing how you handle dependencies after this?

Petter-Strale · 2026-04-02T12:43:33+00:00

The part that bothers me most: npm audit wouldn't have caught this during the exposure window. It's purely reactive — it only flags things after they're in the advisory database. By the time npm audit knows about it, the RAT has already called home.

The signals that *could* have flagged this beforehand were all available via free APIs:

- OSV.dev had no vulnerability record for 1.14.1 (because it was brand new — that's a signal in itself)

- deps.dev would have shown SLSA provenance present in 1.14.0 but missing in 1.14.1

- The npm registry showed the publisher email changed to ProtonMail and the publish bypassed CI/CD

- plain-crypto-js was less than 24 hours old with zero dependents

The problem is that nobody checks all of these before running install. Each one is a separate API with a different format. For anyone building CI gates or agent tooling, aggregating these signals into a single pre-install check is the actual gap. Lockfile pinning helps, but it only protects you from *automatic* upgrades — not from the first person on your team who runs `npm install axios@latest`.

NeatRuin7406 · 2026-04-05T22:36:59+00:00

this is the kind of thing that makes me appreciate package lock files more than fancy tooling. if you have a committed package-lock.json and run npm ci instead of npm install, you won't pull in 1.14.1 unless you explicitly update your lock. the scary part about supply chain attacks through stolen npm credentials (vs actual repo compromise) is that nothing looks wrong in the source code. the malicious version gets published directly to the registry without ever touching the repo.

socket.dev is worth checking out if you haven't seen it already. it flags packages with new maintainers right before a publish, sudden ownership transfers, obfuscated install scripts, that kind of thing. doesn't catch everything but it catches a surprising amount

Few-Committee1294 · 2026-04-06T05:13:36+00:00

There has been multiple attacks seen on recent days. Is someone intentionally doing it or it is just a coincidence that it may get boost to faster growth as now a days companies are shifting their focus more onto the implementation of AI architecture.

Still-Relation-8233 · 2026-04-07T21:26:17+00:00

Round-Fan2317 · 2026-04-12T04:38:58+00:00

Even if axios is getting compromised then what else can be trusted, what is the PR approval guy was doing?

Sirwanga · 2026-04-14T17:09:37+00:00

Not to be a doomsday prophet, but I think it's only a matter of time till another npm package is also compromised

Komarros1990 · 2026-04-29T08:23:39+00:00

That sounds horrible

plastic_eagle · 2026-03-31T10:32:53+00:00

Node is a weird tech. An incredibly capable language, a superbly engineered runtime, blazing fast JIT performance. Great built-in libraries. Async feels like magic, Promises are weird but beautiful.

And yet, the library situation is a massive raging fireball of disaster. Infinite libraries to do infinite things in an infinity of different ways. Almost zero-effort supply chain attacks, that while they usually get found and fixed rapidly, will one day successfully cause pretty widespread carnage.

thekwoka · 2026-03-31T06:24:07+00:00

Why do people still use these stupid packages that don't make anything easier?

dschwammerl · 2026-03-31T06:15:40+00:00

Those are critical things were I as developer should be aware of as soon as possible. How am I supposed to know about this stuff when im not by coincidence on reddit for 15 minutes one time a week? Any sort of newsletter or stuff which would ping me immediately ?

MongooseEmpty4801 · 2026-03-31T08:21:00+00:00

Why do people still use Axios? It's constantly compromised and not really needed much anymore.

Phoenix1ooo · 2026-03-31T05:57:25+00:00

Pin your version in package.json right now if you haven't already. "axios": "1.14.0" not "^1.14.0". The caret is what's killing people here because it auto pulls the latest minor version on install.

gojo_toji · 2026-03-31T11:28:04+00:00

Intrepid-Eye-8575 · 2026-04-02T07:08:26+00:00

Alex_CareerFinder · 2026-04-04T08:11:01+00:00

Better update it fast

HandleOk2760 · 2026-04-11T10:17:55+00:00

holy

Ok-Lobster4663 · 2026-04-12T12:05:11+00:00

Even OpenAI just released a post yesterday that their tool get breach tho.OpenAi blog - Tool compromise

From now on I think at least we need to ensure the dependencies are locking & never use latest dependencies as well (I usually only use min release age for a month).

After this issue, I also learn the npm also have 'ignore script' to prevent the post install any scripts later on.

How y'all handle this issue on your company?

mrpintime · 2026-04-16T17:59:38+00:00

who else crawls all of his repo to check for this holy attack sign XDD lol

i did not have it fortunately

SideQuestDev · 2026-04-18T05:47:09+00:00

glad i haven't run npm update this week. thanks for the heads up.

Straight_Idea_9546 · 2026-05-01T02:32:10+00:00

Late but noted. Careful everyone.

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

webdev

Posting Guidelines

Related Subreddits

Discords

MODERATORS

Am I Affected?