Country visual unavailable
No information
Axios npm account compromise distributes malicious package versions
A compromised Axios maintainer account was used on 31 March 2026 to publish malicious npm versions 1.14.1 and 0.30.4. The poisoned releases added plain-crypto-js 4.2.1, whose install hook deployed a cross-platform remote access trojan. The malicious Axios versions were available for about three hours before removal, creating a software-supply-chain compromise for downstream projects that installed them. Google Threat Intelligence attributed the activity to North Korea-nexus actor UNC1069.
74
Estimated severity
74 / 100
98
Source reliability
98 / 100
Approximate Date
31/03/2026
Targeted Company
AXIOS
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
No information
Geographic Impact
Country Targeted Company
Other Affected Countries
No other affected countries reported
Target country
No information
Affected countries
No information
Impacted regions
No information
Operational Impact
Duration
0.13 days
Financial impact (USD M)
No information
Impact types
Supply chain data integrity impact
Affected sectors
Technology & IT Services
Affected departments
Information TechnologyDistribution & Fulfillment
Attack Profile
Attack types
Account takeoverSoftware supply chain compromiseRemote access trojan
Attributed threat actors
UNC1069
Sources
Incident Sources
github.comhttps://github.com/axios/axios/issues/10636?timeline_page=1cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-packageresearch.jfrog.comhttps://research.jfrog.com/post/axios-compromise/stepsecurity.iohttps://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan