Threat actors compromised the npm account of Axios's lead developer and published malicious package versions containing hidden dependencies that execute postinstall scripts. These scripts automatically download and deploy a remote access trojan on systems installing the affected Axios versions, enabling attackers to gain full remote access, steal credentials, and potentially insert malicious code into software builds. The attack targets developer environments and CI/CD pipelines, leveraging npm's automated installation process. Detection involves monitoring for suspicious process execution patterns and network connections to attacker-controlled domains. No vendor advisory or patch information is currently available.

The compromise results in full remote access capabilities on affected systems, exposing sensitive credentials including API keys and SSH keys. It also risks the integrity of software builds by allowing malicious code insertion. The attack can propagate through developer environments and CI/CD pipelines, potentially affecting downstream software consumers. No known exploits in the wild are reported, but the automated nature of the postinstall script execution increases the risk of widespread impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or guidance is available, developers should avoid installing the affected Axios versions (1.14.1 and 0.30.4) and verify package integrity through trusted sources. Monitoring for suspicious npm postinstall activity and network connections to known attacker domains (e.g., sfrclak.com) is recommended. Consider using package integrity verification tools and restricting automated script execution during package installation in CI/CD environments.