Story
Axios compromised on NPM – Malicious versions drop remote access trojan
1 report
1 website
1 discussion
Latest report
Overview
Two malicious versions of the axios HTTP client library, axios@1.14.1 and axios@0.30.4, were published to npm using compromised credentials of a lead maintainer. The attacker altered the maintainer's email to a ProtonMail address and manually published the malicious packages, which included a remote access Trojan.
Summary from stepsecurity.io.
Reports
One report so far. Additional coverage will appear here when it is linked to this story.
Community reactions
Each reaction summarizes sampled comments from the linked discussion.
Hacker News · stepsecurity.io
Hacker News discussion ↗
Historical count: 5 · 5 saved in sample · Historical sample
Analysis ready
Read this discussion’s reaction
Based on 5 sampled comments from this thread. Analyzed 2026-03-31.
- Praise: The introduction of minimum release age settings in npm, bun, and pnpm can significantly enhance package security by preventing the immediate installation of potentially harmful updates.
- Concern: The compromise of Axios highlights a critical vulnerability in package management systems, raising concerns about the safety and reliability of widely-used dependencies.
- Concern: There is a growing anxiety among developers about the security of package managers, with fears that similar incidents could occur in other ecosystems like Rust.
- Concern: The reliance on untrusted dependencies in projects creates a significant risk, leading to a lack of confidence in using popular programming languages like Python and Node.js.