Popular JavaScript Package Axios Gets Compromised - DTNS 5237  🔗 **Source:** [Popular JavaScript Package Axios Gets Compromised - DTNS 5237](https://share.snipd.com/episode/23c83e75-702d-4a11-94e4-2bcde2e5181d) ## Highlights - **Axios NPM Supply Chain Compromise** - A supply-chain attack compromised the Axios NPM maintainer account and pushed malicious Axios 1.14 and 0.30 releases that installed a remote-access Trojan on macOS, Windows, and Linux. - The Trojan ran a post-install script, executed commands, persisted across reboots, and then replaced the modified package with a clean file to avoid detection. Transcript: Tom Merritt Yes. Jason prompted my deep learning package. So and security professionals, we are going to simplify some things here. So do forgive us. But I think this is mostly going to give people the accurate permission or accurate impression. And you should go dig into it more if you are affected. An attacker compromised the maintainer account of the lead maintainer of the node package manager for, as Jason said, one of the most widely used JavaScript HTTP client libraries Known as Axios. This has nothing to do with the publication Axios. I was a little confused when I first started seeing the headlines here. This just happens to share the same name. Developers use the Axios NPM in apps to make requests to servers and APIs. So it's how your app is going to communicate with other things. It can manage requests between browsers, between Node.js apps, between servers, and it just makes things simple. You take this package, you put it in your app, and now you can communicate with things. And so, as you might expect, it's downloaded approximately 100 million times a week. People are putting it in their stuff all the time. The attacker was able to put a dependency in Axios 1.14 and Axios 0.30 that would install a remote access Trojan or something very like a remote access Trojan on machines running macOS, Windows, and Linux. So pretty much any machine. The Trojan worked a little differently. Actually, the download worked a little differently depending on the platform, but you'd end up with the same Trojan. It was disguised as a legitimate cryptography library. The malicious package was not referenced or imported anywhere in the Axios source code, so there weren't any obvious things to look for if you were scanning for it. It executed a post-install script to install a backdoor, which was capable of remote command execution. And then once it got all the stuff it wanted, removed the modified package and replaced that package with a clean file to avoid detection. So if you scanned it afterwards, you wouldn't see any trace of it. The Trojan could then execute commands and maintain persistence through reboots and all of that. They were published without an automated OIDC package origin or GitHub commit. So all that means is some of the automated alerts that would tip you off to something untoward being in there were avoided. They took like 18 hours to set up a fake history to make sure that you couldn't tell that this was coming from a compromised account. The malicious versions were actually live for about two to three hours before they were unpublished and a security hold was placed on the affected package. If you are a user of Axios, you should lock at Axios 1.14 and Axios 0.30 and treat any system that ran the malicious packages as fully compromised. Don't try to figure out if they got in. Just assume they did. Rotate your credentials, rebuild your environments from a pre-infection state. We don't know who did this yet. Usually there's a clue. We don't have a clue about who's responsible. Nobody's taking responsibility. It was a pretty sophisticated attack though. So this isn't just somebody random. ([Time 0:01:50](https://share.snipd.com/snip/5778aae4-d17a-4fe4-856b-b6e9c79116d2)) - **Axios Ubiquity Makes It An Attractive Target** - Axios is a ubiquitous HTTP client used in browsers and Node.js servers, downloaded about 100 million times per week, making it a high-value target for supply-chain attacks. - Because it's included in many apps front-end and back-end, even a short malicious release can affect a large number of projects and machines. Transcript: Tom Merritt So it's how your app is going to communicate with other things. It can manage requests between browsers, between Node.js apps, between servers, and it just makes things simple. You take this package, you put it in your app, and now you can communicate with things. And so, as you might expect, it's downloaded approximately 100 million times a week. People are putting it in their stuff all the time. ([Time 0:02:39](https://share.snipd.com/snip/a0f2926b-7253-46d4-aa7f-5e78d6aa96fc)) - **Disguised Dependency And Post Install Cleanup** - The malicious package was disguised as a legitimate cryptography library and not imported in Axios source code, so static scans wouldn't reveal it. - Post-install scripts delivered the backdoor and later cleaned traces by replacing modified files with clean ones. Transcript: Tom Merritt It executed a post-install script to install a backdoor, which was capable of remote command execution. And then once it got all the stuff it wanted, removed the modified package and replaced that package with a clean file to avoid detection. ([Time 0:03:46](https://share.snipd.com/snip/a2558d2f-7e53-4f96-89d6-a721afdb9856)) - **Sophisticated Evasion Hid The Malicious Release** - Attackers avoided automated detection by publishing without OIDC package origin or GitHub commit and building a fake history over ~18 hours to mask the compromise. - Malicious versions remained live only 2–3 hours before being unpublished, complicating detection and attribution. Transcript: Tom Merritt They were published without an automated OIDC package origin or GitHub commit. So all that means is some of the automated alerts that would tip you off to something untoward being in there were avoided. They took like 18 hours to set up a fake history to make sure that you couldn't tell that this was coming from a compromised account. The malicious versions were actually live for about two to three hours before they were unpublished and a security hold was placed on the affected package. ([Time 0:04:15](https://share.snipd.com/snip/e5ff68ac-0d0b-4dac-8d05-e75fc86dc901)) - **Treat Affected Systems As Fully Compromised** - If your build used Axios 1.14 or 0.30 during the window, assume compromise: rotate credentials, rebuild environments from pre-infection state, and lock or roll back Axios versions. - Do not try to determine partial infection; treat any affected system as fully compromised and remediate accordingly. Transcript: Tom Merritt If you are a user of Axios, you should lock at Axios 1.14 and Axios 0.30 and treat any system that ran the malicious packages as fully compromised. Don't try to figure out if they got in. Just assume they did. Rotate your credentials, rebuild your environments from a pre-infection state. ([Time 0:04:51](https://share.snipd.com/snip/2597cc34-e1d5-4ea3-b1e0-fabf2d67372c)) - **Short Window Can Still Cause Wide Impact** - Even a short live window (a few hours) can affect many systems when a package is highly popular, but quick developer response likely rolled back many uses. - Service outages or odd updates around that time could be related as developers scrambled to patch. Transcript: Jason Howell Yeah, I think as I've been trying to, you know, kind of poke through some of the reporting on this and understand it on a deeper level, because I, you know, I'm not a developer. I say that all the time. I love talking about these things because I learn a lot more about, well, at least my understanding of how these things happen on the back end. But I'm sure developers listening to this understand this on a deeper level and know what the payload could potentially be ([Time 0:05:36](https://share.snipd.com/snip/c7cee41f-ce42-45c6-8c72-c43fb83d57dd)) - **What Nondevelopers Should Do About The Attack** - End users generally aren't the direct targets of this attack; focus remediation on affected services and developers rather than personal devices. - If a service you use notifies of a breach, there may be nothing you can do beyond following their guidance and rotating passwords where advised. Transcript: Tom Merritt A fair question. The target of this is probably the developer, not you. Okay. This doesn't necessarily mean they were going after your information. Okay. We'll find that out. And the real answer is, we don't know. At the point where we're recording this, and you may know more now because you're listening to it later, we don't know who was infected. So we don't know if some app installed this Trojan, didn't get to an end time. And there's evidence that someone accessed a database and that database has your, your user information. Uh, even if we did know that there's nothing you could do about it. This is, this is that kind of attack, uh, where there's, there's not much you could do. And, and it's the kind of thing that it's, it's not a vulnerability. I don't think in your software on your machine. Um, it, is the kind of vulnerability that is in their back-end and front-end servers and cloud communication stuff. And the tools that they're using to create and iterate and all that kind of stuff. Your information could be the target if you're dealing with a service that stores your information, but you are not the target for this. The target is that bigger payload. ([Time 0:06:39](https://share.snipd.com/snip/12ed0761-dbae-4190-a6d0-7e616eb43874)) - **Personal Note About A Morning Smart Home Glitch** - Tom Merritt mentions his Echo couldn't turn on lights that morning, suggesting odd service behavior might be connected to the Axios incident. - He frames this as possibly coincidental but illustrative of user-facing outages during such rollbacks. Transcript: Tom Merritt If you got a weird update to an app, that could be why. If you had a service outage and you don't know why there's a service outage, for instance, I tried to get my Echo to turn on my lights this morning and it was like, I can't do that right now. I was like, oh, is that just a coincidence? Probably a coincidence, but you never know. There could be something related to this. ([Time 0:09:22](https://share.snipd.com/snip/57d5b85f-ca3c-4de6-9ab9-d5d19e05c60c))