The axios@1.14.1 compromise,
and where the firewall stops it.
In March 2026, attackers social-engineered the lead axios maintainer, hijacked his npm tokens, and shipped two malicious versions that pulled in a purpose-built RAT dropper. No CVE existed. Here is the timeline, and the moment CyberXYZ blocks it.
-
~2 weeks before
The maintainer is targeted
An attacker impersonates a company founder, lures the lead axios maintainer from a fake Slack into a Microsoft Teams call, and gets him to install a fake "missing component". It steals his npm tokens, bypassing 2FA entirely.
-
Mar 30 · 05:57 UTC
A clean decoy is planted
plain-crypto-js@4.2.0is published, completely clean, to build legitimate-looking registry history before the payload lands. -
Mar 30 · 23:59 UTC
The payload ships · commit-level signal fires
plain-crypto-js@4.2.1adds a maliciouspostinstallhook (setup.js) using reversed-base64 and XOR to hide a cross-platform RAT dropper. CyberXYZ reads the change at the commit level and flags the new lifecycle hook and obfuscation, no CVE required. -
Mar 31 · 00:21 UTC
axios pulls it in · dependency-injection signal fires
axios@1.14.1(taggedlatest), then0.30.4(legacy), addplain-crypto-jsas a dependency, one that has never existed in any prior axios. Two independent signals now agree. -
the verdict
BLOCK, at install time
Across every surface,
npm install axios@1.14.1through the proxy returns403, CI gates fail, the editor flags it, the CLI exits non-zero. The RAT dropper never reaches a developer's disk. No advisory needed. -
Mar 31 · 03:15 UTC
npm removes the versions
Roughly a three-hour exposure window for everyone relying on after-the-fact takedown.
-
Apr 1
Attribution: Sapphire Sleet
Microsoft Threat Intelligence links the campaign to a North Korean state actor and maps it to MITRE ATT&CK supply-chain techniques.
-
Apr 20
The CISA advisory lands · three weeks later
By the time the formal advisory existed, the window was long closed. CyberXYZ blocks at install, the moment the dependency appears, no CVE needed.
Not an advisory after the fact.
The receipt.
The instant axios@1.14.1 reached the proxy, every runner and laptop got the same verdict. This is exactly what the team saw, three weeks before any CVE existed.
axios@1.14.1BLOCKEDgha/runner CI/CD LinuxinternalCRITICALaxios@0.30.4BLOCKEDgitlab/runner CI/CD LinuxinternalCRITICALplain-crypto-js@4.2.1BLOCKEDdev laptop DEV macOSinternalCRITICALfig. 01 · proxy findings · both malicious axios tags blocked the moment they appeared
Blocked install: axios@1.14.1 on gha/runner · GitHub Actions
plain-crypto-js@4.2.1 added an obfuscated postinstall (setup.js, reversed-base64 + XOR) dropping a cross-platform RAT. Read at the commit level, no CVE required.
axios@1.14.1 added plain-crypto-js, a dependency that had never existed in any prior axios release. Two independent signals now agree.
Campaign linked to Sapphire Sleet (DPRK), mapped to MITRE ATT&CK supply-chain techniques.
fig. 02 · install verdict · the XYZ score and the three signals that fired
Sources: CyberXYZ threat intelligence, Microsoft Threat Intelligence (Sapphire Sleet attribution, Apr 2026) and the CISA advisory (Apr 2026). Full technical write-up on the CyberXYZ blog.