Axios Library Hit by Supply Chain Attack; Malicious Packages Affect 80% of Cloud Environments

ChainCatcher reports that the attacker stole the npm access token of the lead maintainer of Axios, the most popular JavaScript HTTP client library, and used it to publish two malicious versions containing a cross-platform remote access trojan (RAT)—axios@1.14.1 and axios@0.3.4—targeting macOS, Windows, and Linux systems. The malicious packages were removed from the npm registry after approximately three hours. According to data from security firm Wiz, Axios is downloaded over 100 million times per week and is present in approximately 80% of cloud and code environments. Security firm Huntress detected the first infections just 89 seconds after the malicious packages went live and confirmed at least 135 compromised systems during the exposure window. Notably, the Axios project had already implemented modern security measures such as OIDC trusted publishing and SLSA provenance, yet the attacker fully bypassed these protections. Investigation revealed that while OIDC was configured, the project retained a traditional, long-lived NPM_TOKEN, and npm defaults to using the traditional token when both are present, allowing the attacker to publish without circumventing OIDC.