Poisoned Pipeline / Incidents / AS22
axios npm remote-access trojan
In March 2026, alongside the Team PCP wave, malicious versions axios@1.14.1
and axios@0.30.4 pulled in a fake dependency that dropped a cross-platform
remote-access trojan on install, called attacker C2, then tried to erase
traces. axios has over 100 million weekly downloads. StepSecurity's
Harden-Runner captured the live C2 callback during a GitHub Actions run
in CNCF's Backstage repository.
Mapped techniques
- T0121 Compromised legitimate artifact
- T0109 Publish malicious artifact
- T0181 Malicious module injection
- T0151 Installation scripts
- T0159 Malicious artifact execution
- T0145 Bypass of outbound traffic control
- T0176 Disable or misconfigure security measures
- T0201 Customers compromised
supply-chain axios on npm
Two versions of axios, one of the most downloaded npm packages, shipped
a malicious extra dependency.
Malicious versions 1.14.1 and 0.30.4 were published to npm.
A fake dependency carried the RAT rather than axios source itself.
post-supply-chain Installers including CNCF Backstage CI
The RAT dropped on install.
Harden-Runner observed the C2 callback in a Backstage GitHub Actions run.
The malware called home from CI; it was built to erase evidence of that call.
After the C2 callback the malware attempted to wipe its own traces.
Any project resolving those axios versions, including CNCF Backstage CI,
executed the payload.
Sources
- https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
- https://www.stepsecurity.io/blog/state-of-open-source-supply-chain-attacks
- https://opensourcemalware.com/blog/axios-compromise-transitive-dependency
- https://opensourcemalware.com/blog/axios-attacker-strikes-again
- https://safedep.io/axios-npm-supply-chain-compromise
- https://socket.dev/blog/axios-npm-package-compromised
- https://www.cisa.gov/news-events/alerts/2026/04/20/supply-chain-compromise-impacts-axios-node-package-manager
- https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package
- https://www.wiz.io/blog/axios-npm-compromised-in-supply-chain-attack
- https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/
- https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise