Malicious Dependency Hits Axios Npm Package, Urging Immediate Version Pinning
Feross warns of an active supply chain attack in which axios@1.14.1 pulls in a newly created malicious package, plain-crypto-js, which acts as a dropper. He advises pinning versions and auditing lockfiles immediately, citing analysis from Socket AI.
Original post · 1 min read
The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.