Technology News and Headlines

Axios Compromised on NPM – Malicious Versions Drop Remote Access Trojan

On March 30‑31 2026, attackers compromised the npm maintainer account for the popular HTTP client library axios and published two malicious releases, axios@1.14.1 and axios@0.30.4. Both versions added a fake dependency, plain‑crypto‑js@4.2.1, which runs a post‑install script that drops a cross‑platform remote‑access trojan. npm removed the compromised packages within hours and placed a security hold on the malicious dependency. The attack leaves no malicious code in axios itself; the payload is delivered entirely by the injected dependency.