Axios npm Supply Chain Compromise: Mitigation Guide

Introduction

Microsoft has disclosed a serious npm supply chain compromise affecting Axios, one of the most widely used JavaScript HTTP libraries. Because Axios is commonly installed on developer workstations and CI/CD pipelines, this incident has broad implications for software supply chain security across Windows, macOS, and Linux environments.

What happened

Two malicious Axios package versions were published on March 31, 2026:

• [email protected]
• [email protected]

According to Microsoft Threat Intelligence, these releases added a malicious dependency, [email protected], which executed a post-install script during npm install or package updates. The install hook contacted actor-controlled infrastructure and downloaded a second-stage remote access trojan (RAT).

Microsoft attributes the campaign to Sapphire Sleet, a North Korean state actor.

Key technical details

• The Axios source code itself was reportedly left unchanged.
• The malicious behavior was introduced through a dependency insertion technique.
• Affected environments included developer endpoints and CI/CD systems.
• Payloads were tailored by operating system:
  • Windows: PowerShell-based RAT with persistence via registry Run key
  • macOS: Native binary dropped into /Library/Caches
  • Linux/other: Platform-specific follow-on payloads
• The malware communicated with known malicious infrastructure linked to Sapphire Sleet.

Why this matters for IT and security teams

This attack highlights how trusted open-source packages can be weaponized without obvious application changes. Even if applications appear to function normally, the compromise can still occur at install time, allowing attackers to steal secrets, establish persistence, and pivot deeper into enterprise environments.

For administrators, the biggest risks are:

• Compromised developer credentials and tokens
• Exposed secrets in build systems
• Malware execution on CI/CD agents
• Persistent footholds on managed Windows devices

Recommended actions

Organizations that installed the affected Axios versions should act immediately:

1. Downgrade Axios to safe versions:
   • 1.14.0
   • 0.30.3
2. Rotate secrets and credentials that may have been exposed.
3. Disable auto-updates for Axios packages until environments are verified clean.
4. Inspect developer and build systems for signs of compromise, especially persistence mechanisms and suspicious script execution.
5. Use Microsoft Defender detections and hunting guidance from Microsoft’s advisory to identify malicious components and affected hosts.

Bottom line

The Axios npm compromise is a reminder that package management and CI/CD pipelines are now primary attack surfaces. Security teams should treat affected installs as potential endpoint and credential compromises, not just a package issue.