TechFlow reports that on April 2, according to VentureBeat, attackers stole the npm access token of Axios’s lead maintainer—the most popular HTTP client library for JavaScript—and used it to publish two malicious versions (axios@1.14.1 and axios@0.30.4) containing a cross-platform remote access trojan (RAT), targeting macOS, Windows, and Linux systems. The malicious packages remained on the npm registry for approximately three hours before being removed.
According to security firm Wiz, Axios is downloaded over 100 million times per week and resides in roughly 80% of cloud and code environments. Security firm Huntress detected the first infections just 89 seconds after the malicious packages went live and confirmed at least 135 compromised systems during the exposure window.
Notably, the Axios project had already implemented modern security measures—including OIDC-based trusted publishing and SLSA provenance attestations—yet attackers fully bypassed these defenses. The investigation revealed that while OIDC was configured, the project retained legacy long-lived NPM_TOKENs; npm defaults to using such traditional tokens when both OIDC and legacy tokens coexist, enabling attackers to publish malicious packages without needing to breach the OIDC system.
