Microsoft Details Mitigations for Axios npm Supply Chain Compromise

Key Takeaways

• A significant supply chain attack targeting the popular Axios JavaScript library was discovered on March 31, 2026.
• Malicious code was embedded in Axios npm package versions 1.14.1 and 0.30.4, silently installing remote access trojans (RATs) on developer systems across Windows, macOS, and Linux.
• The attack has been attributed to Sapphire Sleet, a North Korean state-sponsored threat group known for targeting financial organizations.
• Microsoft has provided detailed mitigation steps, including downgrading Axios, rotating credentials, and blocking malicious infrastructure.

A sophisticated supply chain attack impacting Axios, a widely adopted JavaScript library, was uncovered on March 31, 2026. In response, Microsoft has released a comprehensive guide detailing crucial steps to mitigate the npm supply chain compromise.

The compromised Axios npm package versions, specifically 1.14.1 and 0.30.4, were found to contain insidious code designed to install harmful software on developer machines without any visible indicators or warnings to the users or development teams.

Axios is an exceptionally prevalent JavaScript package, boasting over 70 million weekly downloads globally. Developers frequently integrate it into their web and backend applications for handling HTTP requests. Its extensive use across numerous projects means that even a minor, targeted alteration within one of its releases can simultaneously impact thousands of organizations, automated build pipelines, and active production environments.

Microsoft Threat Intelligence analysts successfully identified the infrastructure behind this attack, linking it directly to Sapphire Sleet. This North Korean state-sponsored threat group has been active since at least March 2020.

Sapphire Sleet’s primary objectives revolve around financial targets, including cryptocurrency exchanges, venture capital firms, and blockchain organizations, with the ultimate goal of exfiltrating digital assets and sensitive financial data. The group is also known for leveraging platforms such as LinkedIn to engage potential victims, directing them toward malicious files hosted on attacker-controlled cloud storage services.

The attack mechanism involved injecting a fraudulent dependency named [email protected] into the two compromised Axios versions. This dependency silently executed a post-install script that established communication with a command-and-control (C2) server, subsequently downloading a second-stage remote access trojan (RAT).

The malicious payload was specifically engineered for different operating systems, with distinct, platform-specific RAT versions delivered to Windows, macOS, and Linux systems, ensuring broad compromise regardless of the developer’s environment. This adaptability made the attack particularly effective.

A critical aspect that amplified the danger of this attack was its exploitation of npm’s inherent auto-update functionality. Any project configured to automatically fetch minor or patch updates for Axios would inadvertently resolve to the compromised release during a standard installation or update process. This allowed the malicious chain to execute without requiring any explicit actions from the developer, making it exceptionally stealthy.

Silent Dependency Injection: How the Attack Stayed Undetected

Rather than directly modifying Axios’s core source code, the attackers cleverly embedded plain-crypto-js as a new dependency. This dependency became active exclusively during the installation phase. When a developer initiated npm install, or when a CI/CD pipeline triggered a build, the package manager automatically resolved and installed [email protected] in the background.

The lifecycle script within this malicious package then launched setup.js. This initial-stage loader employed multiple layers of obfuscation to reconstruct sensitive strings during runtime before discreetly connecting to the attacker’s server located at hxxp://sfrclak[.]com:8000/6202033.

To evade early detection, the attackers initially published a benign version ([email protected]) to establish a credible publishing history before introducing the malicious 4.2.1 update. On Windows systems, setup.js deployed a VBScript stager, which in turn launched a PowerShell RAT, achieving persistence through a registry run key. For macOS, a native binary named com.apple.act.mond was stealthily placed within the Library/Caches folder. On Linux, a Python payload, ld.py, was written to the /tmp directory and executed in the background. Once the second-stage payload was operational, setup.js self-removed and replaced the original package manifest with a clean-looking copy, complicating post-incident forensic analysis.

What You Should Do

• Immediately roll back all Axios deployments to version 1.14.0 or 0.30.3.
• Rotate any secrets or credentials that may have been exposed on compromised systems.
• Remove caret (^) and tilde (~) prefixes from package.json files and lock Axios to an exact version number to prevent automatic, potentially malicious, upgrades.
• Execute npm cache clean --force to purge any cached malicious packages from your system.
• Audit CI/CD logs for any installations of the affected Axios versions (1.14.1 and 0.30.4).
• Inspect developer machines for the presence of the plain-crypto-js folder within node_modules directories.
• Block outbound network traffic to the malicious C2 server at sfrclak[.]com and IP address 142.11.206[.]73 on port 8000.
• Configure automated dependency management tools like Dependabot or Renovate to restrict Axios updates until this threat is fully resolved and a safe path forward is confirmed.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.