Axios npm Package Compromised: North Korean Hackers Target 100M Weekly Downloads

March 31, 2026 was a bad day for the JavaScript ecosystem. The same day as the Claude Code sourcemap leak, a separate and more dangerous incident was quietly unfolding: axios, the HTTP client library with over 100 million weekly npm downloads, had two backdoored releases published by attackers who had compromised the lead maintainer’s npm account.

Microsoft’s threat intelligence team has attributed the attack to Sapphire Sleet, a North Korean state-sponsored group also tracked as UNC1069. The malware family used in the payload is WAVESHAPER.V2.

What Happened

jasonsaayman’s npm account, the lead maintainer of axios, was compromised, though the exact mechanism hasn’t been publicly disclosed. With control of the account, the attackers published two malicious releases within a 39-minute window:

• axios@1.14.1, tagged as latest, the version that npm install axios would pull by default
• axios@0.30.4, tagged as legacy, targeting projects on the older 0.x branch

Both releases included a malicious dependency: plain-crypto-js@4.2.1. That’s a newly registered package with a similar name to the legitimate crypto-js, designed to look plausible in a package-lock.json file at a quick glance.

The malicious dependency delivered a cross-platform Remote Access Trojan. WAVESHAPER.V2 targets Windows, macOS, and Linux, with platform-specific payloads that handle the differences in process management and persistence mechanisms across operating systems.

The Window of Exposure

The backdoored releases were live for approximately two to three hours before being identified and removed. During that window, any developer or automated system that ran npm install, npm update, or npm ci with axios as a dependency would have pulled the compromised version.

That’s a wide blast radius across the entire JavaScript ecosystem. Axios appears in the dependency trees of thousands of packages, so projects that don’t directly depend on axios might still have pulled it as a transitive dependency during the exposure window, depending on their version constraints and lock file state.

Safe Versions

• Safe: axios@1.14.0 or any prior 1.x release
• Compromised: axios@1.14.1
• Safe: axios@0.30.3 or any prior 0.x release
• Compromised: axios@0.30.4

If your package-lock.json or yarn.lock shows either of the compromised versions, you installed malicious code. The fix is to downgrade and run npm ci from a clean state to reinstall from your lockfile with the pinned safe version.

Why a RAT Is a Different Kind of Threat

Supply chain attacks that exfiltrate credentials are serious, but they’re often limited in scope to what existed in the environment at the time the malicious package ran. A Remote Access Trojan is a different category of threat.

WAVESHAPER.V2 establishes persistent access on the machine it lands on, creating a channel for ongoing access rather than grabbing what’s there and leaving. The attacker can return, run additional commands, exfiltrate data over time, move laterally to other systems, and maintain presence even if the malicious package is later identified and removed.

For individuals, this means the compromise may extend far beyond npm credentials or project environment variables. For organizations, a developer machine with a RAT installed becomes a potential pivot point into internal networks, company systems, and anything else accessible from that machine.

Attribution and Context

Microsoft’s attribution to Sapphire Sleet places this attack in a pattern of North Korean state-sponsored operations targeting software supply chains and developer toolchains specifically. Sapphire Sleet has been tracked conducting social engineering attacks against developers, compromising package registries, and targeting cryptocurrency-adjacent infrastructure.

The choice to target axios specifically, rather than a more obscure package, suggests the goal was maximum initial access breadth rather than a targeted attack against a specific organization. A widely-installed RAT across millions of developer machines creates options that can be exploited selectively later.

What You Need to Do Now

Check your lockfiles. Look for axios@1.14.1 or axios@0.30.4 in your package-lock.json, yarn.lock, or pnpm-lock.yaml. Scan the full dependency tree, since axios is more likely a transitive dependency than a direct one for most projects, and a scanner that reads the whole tree, like Socket.dev for supply chain security, will find it faster than grep will.

grep -r "axios" package-lock.json | grep "1.14.1\|0.30.4"

Rotate credentials. Any credentials present on a machine that installed the compromised versions should be considered exposed. This includes npm tokens, cloud provider keys, SSH keys, and any secrets accessible from the developer’s environment.

Check for persistence. On macOS, look for unexpected login items and LaunchAgents. On Linux, audit systemd services and cron jobs. On Windows, check startup entries and scheduled tasks.

Don’t just uninstall. Removing the malicious package doesn’t remove a RAT that has already been installed. If you installed the compromised version, treat the machine as potentially compromised until you’ve done a full audit or reimaged it.

---

Three major supply chain attacks in twelve days (Trivy on March 19, LiteLLM on March 24, and now this) is not a coincidence. Developer toolchains are being systematically targeted, and the pattern is worth its own discussion, which I’m covering separately.