CampaignPublished 1 Apr 2026

Axios Front-End Library npm Supply Chain Poisoning Alert

Source AlienVault OTX General

Description

On March 31, NSFOCUS CERT detected that the npm repository of the HTTP client library Axios was poisoned by the supply chain. The attacker bypassed the normal GitHub Actions CI/CD pipeline of the project, changed the account email address of the axios maintainer to an anonymous ProtonMail address, and manually released a malicious version with a Trojan backdoor through the npm CLI. When the user installs it, a persistent remote control will be established on the host. The impact is wide-ranging, and relevant users are requested to take measures for investigation and protection as soon as possible.

Impact

This supply chain attack on Axios poses a significant risk to organizations worldwide due to Axios's widespread adoption in web and server applications. The Trojan backdoor enables persistent remote access, potentially compromising confidentiality, integrity, and availability of affected systems. Attackers could steal sensitive data, deploy ransomware, or use compromised hosts as footholds for further network intrusion. The attack undermines trust in the npm ecosystem and open-source supply chains, potentially affecting thousands of development projects and production environments. Organizations relying on Axios without verification of package authenticity are particularly vulnerable. The incident could lead to operational disruptions, data breaches, and reputational damage. Given the broad usage of Axios across industries, the impact could be extensive if malicious versions are widely installed before detection and remediation.

Defensive guidance

1. Immediately audit all systems and development environments for the installation of any suspicious or unexpected Axios package versions, using the provided malicious hashes for detection. 2. Revert to a known good Axios version from a verified source and avoid installing any versions released after March 31, 2026, until official patches or statements are issued. 3. Implement strict verification of package integrity using cryptographic signatures or checksum validation before deployment. 4. Enhance CI/CD pipeline security by enforcing multi-factor authentication, restricting permissions, and monitoring for unauthorized changes to maintainer accounts and repository settings. 5. Monitor network traffic for connections to identified malicious domains (callnrwise.com, sfrclak.com) and URLs to detect potential command and control communications. 6. Educate development teams about supply chain risks and encourage use of tools that scan dependencies for known vulnerabilities or malicious code. 7. Collaborate with npm and Axios maintainers to track updates and apply official patches promptly once available. 8. Consider implementing runtime application self-protection (RASP) or endpoint detection and response (EDR) solutions to detect anomalous behaviors caused by backdoors.

Indicators of compromise

Domains 2

callnrwise.com
sfrclak.com

URLs 1

http://sfrclak.com:8000/6202033

Hashes 3

07d889e2dadce6f3910dcbc253317d28ca61c766
2553649f2322049666871cea80a5d0d6adc700ca
d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Apr 2026, 15:24 UTC

Technical details

Indicators of compromise

Domains 2

URLs 1

Hashes 3

Community reviews

Related threats