Axios NPM Package Under Active Supply Chain Attack, Potentially Impacts 100M+ Weekly Installs

A critical security alert is circulating among developers after reports emerged that the popular JavaScript HTTP client library Axios may be under an active software supply chain compromise. The incident, first highlighted by security researcher Kimmo on X, suggests that the newest release of the package pulls in a brand-new dependency that behaves like installer malware.

What Happened

According to the alert, the suspicious dependency exhibits multiple behaviors characteristic of malicious software:

• Runtime deobfuscation: The code appears to be obfuscated and only reveals its true functionality during execution.
• Shell execution: The package reportedly executes shell commands, a significant red flag for a library that should only handle HTTP requests.
• Temporary directory staging: Files are staged in temporary directories, a common technique for malware to avoid detection.
• Artifact cleanup: The dependency cleans up after itself, removing traces of its activity.

The scale of the potential compromise is massive. Axios is downloaded over 100 million times per week according to npm statistics, making it one of the most depended-upon packages in the JavaScript ecosystem. It's used by virtually every major JavaScript framework (React, Vue, Angular, Node.js) and powers HTTP communication in countless web applications, mobile apps, and backend services.

Immediate Actions Required

The security researcher provided specific, urgent recommendations for developers and organizations:

1. Pin your Axios version immediately: Lock your dependency to a known-safe version (likely v1.7.7 or earlier) using exact version pinning in your package.json.
2. Freeze all upgrades: Temporarily halt all package updates in development and CI/CD pipelines.
3. Audit lockfiles: Scrutinize package-lock.json or yarn.lock files for unexpected dependencies or version changes.
4. Check CI/CD installs: Review recent builds for any suspicious activity or unexpected network calls.

Context: The Growing Threat to AI/ML Development

While Axios itself is not an AI-specific library, its compromise represents a severe threat to the AI/ML development ecosystem for several reasons:

AI Infrastructure Dependency: Nearly every modern AI application, from model training pipelines to inference APIs, relies on Node.js or JavaScript tooling somewhere in its stack. Axios is frequently used for:

• Calling external AI APIs (OpenAI, Anthropic, Google AI)
• Data collection and preprocessing pipelines
• Model deployment and monitoring services
• CI/CD automation for ML projects

Supply Chain Vulnerability Amplification: AI projects have particularly deep dependency trees, often pulling in hundreds of packages. A compromise in a foundational package like Axios could propagate through the entire AI toolchain.

Data Exfiltration Risk: Malicious code in a widely-used HTTP library could intercept sensitive data being sent to AI services, including proprietary prompts, training data, or API keys.

Current Status and Verification

As of this writing, the Axios maintainers have not issued an official statement about the alleged compromise. The npm registry shows the latest version as 1.7.8, released recently. Security researchers are actively analyzing the package and its dependencies.

Key questions remain unanswered:

• Which specific dependency contains the malicious code?
• Is this a deliberate attack or a compromised maintainer account?
• What is the payload's ultimate objective (data theft, cryptocurrency mining, botnet recruitment)?
• How many versions are affected?

Historical Context of NPM Supply Chain Attacks

This incident follows a concerning pattern of software supply chain attacks targeting the JavaScript/npm ecosystem:

• 2021: ua-parser-js compromise: Malicious versions stole environment variables and cryptocurrency.
• 2022: coa and rc protestware: Maintainers intentionally broke their widely-used packages in protest, affecting thousands of projects.
• 2023: node-ipc protestware: The package added code that would delete files on Russian and Belarusian systems.
• 2024: Multiple typosquatting campaigns: Attackers uploaded malicious packages with names similar to popular libraries.

What makes the Axios incident particularly alarming is the package's centrality. While previous attacks often targeted mid-tier dependencies, Axios sits at the foundation of web communication for millions of applications.

Technical Analysis of the Threat

For security teams and developers, understanding the technical indicators is crucial:

Behavioral Red Flags:

1. Unnecessary Shell Access: An HTTP client library has no legitimate reason to execute shell commands. This suggests either credential harvesting, persistence mechanisms, or lateral movement capabilities.
2. Obfuscation and Cleanup: Legitimate packages don't typically obfuscate their code or clean up execution artifacts unless they're hiding malicious activity.
3. New, Unexpected Dependencies: The introduction of a new dependency in a mature, stable package like Axios warrants immediate scrutiny.

Potential Attack Vectors:

• Credential Theft: Intercepting API keys, database credentials, or cloud service tokens from HTTP requests.
• Backdoor Installation: Establishing persistent access to development or production environments.
• Data Exfiltration: Sending sensitive application data to attacker-controlled servers.
• Cryptocurrency Mining: Using compromised systems for crypto mining operations.

Recommendations for AI/ML Teams

AI development teams should take additional precautions:

1. Isolate AI API Calls: Consider using dedicated, minimal HTTP clients for AI service calls rather than general-purpose libraries.
2. Implement Zero-Trust for Dependencies: Treat all third-party code as potentially malicious. Use tools like npm audit, snyk, or osv-scanner continuously.
3. Network Segmentation for Training Pipelines: Ensure that systems running sensitive AI training jobs have restricted network access.
4. Monitor for Anomalous Outbound Calls: Watch for unexpected network traffic from your AI infrastructure, especially to unfamiliar domains.

The Broader Impact on AI Safety

This incident highlights a critical vulnerability in the AI safety ecosystem: the security of AI systems depends on the security of their software dependencies. Even if an AI model itself is secure, compromised infrastructure code can undermine the entire system.

As AI systems become more autonomous and interconnected, supply chain security becomes a foundational requirement, not an afterthought. This Axios incident serves as a stark reminder that the AI community needs to develop more robust dependency management practices, potentially including:

• Verified, audited dependency sets for critical AI infrastructure
• Formal verification of security-critical packages
• Decentralized package signing and verification mechanisms
• Better isolation between AI components and their supporting infrastructure

Frequently Asked Questions

How do I check if I'm using a compromised version of Axios?

Run npm list axios or yarn list axios to see your installed version. If you're using version 1.7.8 or any version released after March 2026, you should immediately revert to version 1.7.7 or earlier and audit your system for suspicious activity. Check your lockfile for any new, unfamiliar dependencies.

What should I do if my application has already installed the compromised version?

First, revert to a known-safe version immediately. Then, rotate all credentials that might have been transmitted through Axios (API keys, database passwords, cloud service tokens). Monitor your systems for unusual network activity, particularly outbound connections to unfamiliar domains. Consider conducting a security audit of any systems that ran the compromised code.

Are AI services like OpenAI's API affected by this?

While the AI services themselves aren't compromised, applications using Axios to call these services could be vulnerable. If your application uses Axios to communicate with OpenAI, Anthropic, Google AI, or similar services, you should assume that any API keys or sensitive data sent through compromised versions may have been exposed and rotate those credentials immediately.

How can I prevent similar supply chain attacks in the future?

Implement multiple layers of defense: Use dependency pinning with exact versions, regularly audit your dependencies with automated tools, implement network egress filtering to detect anomalous outbound calls, maintain an allowlist of acceptable package sources, and consider using software bill of materials (SBOM) tools to track your complete dependency tree. For critical AI infrastructure, consider maintaining a curated set of vetted dependencies rather than pulling directly from public registries.

This is a developing story. We will update this article as more information becomes available from the Axios maintainers, npm security team, or independent security researchers.