The axios@1.14.1 compromise,
and where the firewall stops it.
In March 2026, attackers social-engineered the lead axios maintainer, hijacked his npm tokens, and shipped two malicious versions that pulled in a purpose-built RAT dropper. No CVE existed. Here is the timeline, and where CyberXYZ blocks it. One thing to be clear about: we did not block this attack while it was live. Socket found and disclosed it; the release entered CyberXYZ's malicious-package intelligence on April 4, about four days after Socket's disclosure, and our install telemetry began in early April 2026. axios@1.14.1 has been blocked by CyberXYZ since then; the first block in our install log is dated April 7, 2026.
-
~2 weeks before
The maintainer is targeted
An attacker impersonates a company founder, lures the lead axios maintainer from a fake Slack into a Microsoft Teams call, and gets him to install a fake "missing component". It steals his npm tokens, bypassing 2FA entirely.
-
Mar 30 · 05:57 UTC
A clean decoy is planted
plain-crypto-js@4.2.0is published, completely clean, to build legitimate-looking registry history before the payload lands. -
Mar 30 · 23:59 UTC
The payload ships · what the commit-level signal looks for
plain-crypto-js@4.2.1adds a maliciouspostinstallhook (setup.js) using reversed-base64 and XOR to hide a cross-platform RAT dropper. A new lifecycle hook plus obfuscation is the pattern CyberXYZ's commit-level signal is built to flag, no CVE required. -
Mar 31 · 00:21 UTC
axios pulls it in · what the dependency-injection signal looks for
axios@1.14.1(taggedlatest), then0.30.4(legacy), addplain-crypto-jsas a dependency, one that has never existed in any prior axios. A brand-new dependency on a trusted package is the second pattern CyberXYZ looks for. -
Mar 31 · 03:15 UTC
npm removes the versions
Roughly a three-hour exposure window for everyone relying on after-the-fact takedown.
-
Apr 1
Attribution: Sapphire Sleet
Microsoft Threat Intelligence links the campaign to a North Korean state actor and maps it to MITRE ATT&CK supply-chain techniques.
-
Apr 7 · 04:51 UTC
BLOCK, at install time · from here on
This is the first block of
axios@1.14.1in CyberXYZ's install log, a week after the attack: our telemetry only began in early April, and the block came from our malicious-package intelligence, not from a signal firing. Since then, across every surface,npm install axios@1.14.1through the proxy returns403, CI gates fail, the editor flags it and xyz Scanner exits non-zero. -
Apr 20
The CISA advisory lands · three weeks later
By the time the formal advisory existed, the window was long closed. Even the first public malware records came late in the window: OSV listed
plain-crypto-jsat 02:07 UTC on March 31, and GitHub's advisory for axios itself (GHSA-fw8c-xr5c-95f9) followed at 03:15 UTC, about when npm removed the versions. A gate that waits for an advisory missed most of the exposure. That gap is why CyberXYZ decides at install time instead of waiting for a CVE.
What the proxy returns
for axios@1.14.1.
These are real rows from CyberXYZ's own install log, from our own scans and CI, not a customer's. They start in April 2026, after the attack: we did not block it while it was live. Full IOC tables and the MITRE ATT&CK mapping are in the technical write-up.
axios@1.14.1BLOCKEDSBOM scaninternalCRITICALaxios@1.14.1BLOCKEDgha/runner CI/CD LinuxinternalCRITICALaxios@0.30.4BLOCKEDAPI checkinternalCRITICALfig. 01 · proxy findings · real rows from CyberXYZ's install log, which begins on April 6, 2026, a week after the attack
Blocked install: axios@1.14.1 on gha/runner · GitHub Actions
plain-crypto-js@4.2.1 added an obfuscated postinstall (setup.js, reversed-base64 + XOR) dropping a cross-platform RAT. Read at the commit level, no CVE required.
axios@1.14.1 added plain-crypto-js, a dependency that had never existed in any prior axios release. Two independent signals now agree.
Campaign linked to Sapphire Sleet (DPRK), mapped to MITRE ATT&CK supply-chain techniques.
fig. 02 · illustration · how the signals described above present this attack. These signals did not see it in March 2026. The score is the one our API returns for axios@1.14.1 today, and the real blocks in fig. 01 come from our malicious-package intelligence, a known-malicious-version match
Sources: CyberXYZ threat intelligence, Socket (the public disclosure, Mar 2026), Microsoft Threat Intelligence (Sapphire Sleet attribution, Apr 2026) and the CISA advisory (Apr 2026). Full technical write-up on the CyberXYZ blog.