Malicious axios versions on npm: check your projects and rotate keys
On March 31, 2026, axios 1.14.1 and 0.30.4 were published with malware. Machines that installed them are compromised.
Affects:axios 1.14.1 and 0.30.4 on npmDeveloper machines and build servers
In March 2026, attackers took over the npm account of a main maintainer of axios, a very widely used JavaScript library for making web requests, and published two poisoned versions on March 31, 2026: 1.14.1 and 0.30.4. They did not change axios's own code. Instead, they added a hidden dependency, plain-crypto-js 4.2.1, whose install script dropped a remote access trojan on Windows, macOS and Linux. Singapore's Cyber Security Agency (CSA) described the campaign as combining credential theft, a bypass of the normal publishing pipeline, and efforts to erase its traces.
The danger is at install time. A developer laptop or a build server that ran an install while those versions were available could be under the attacker's control, with access to every key stored there: hosting, database, payment provider, email service. GitHub's advisory says any computer that had the package installed or running should be considered fully compromised, and that removing the package may not remove everything it installed.
Who is affected
Projects that installed axios 1.14.1 or 0.30.4, directly or through another package, and the computers and build servers where that install happened. Sites and apps built with React, Next.js, Node.js and many other tools commonly use axios. Your live site is not automatically infected, but the secrets used to build and deploy it may be exposed.
How to check your site
Ask your developer to search the project's lock file (package-lock.json, yarn.lock or pnpm-lock.yaml) for axios 1.14.1, axios 0.30.4 or plain-crypto-js, and to check build logs from March 31, 2026. If you are not sure whether your project uses axios, it appears in package.json when it does.
What to do now
- Move to a safe version. CSA lists 1.14.0 and 0.30.3 as safe versions to go back to.
- Remove plain-crypto-js from all environments and node_modules folders.
- Treat any machine that installed the bad versions as compromised: rebuild it rather than clean it, and rotate all secrets that were on it, from a different, clean computer.
- Ask your developer to review build logs for unexpected outbound connections, as CSA recommends.
- Projects whose lock file never contained those versions are most likely not affected, but the check takes only a few minutes.
This alert reports what the sources published and is not a guarantee about any specific site.