SECURITY NOTICE — axios supply chain attack (2026-03-31)

DO NOT install axios@1.14.1

A confirmed supply chain attack has been identified in axios@1.14.1, one of npm's most depended-on packages.

What happened

• axios@1.14.1 introduces a new dependency: plain-crypto-js@4.2.1
• This package did not exist before 2026-03-31 and is confirmed malware
• Socket AI analysis confirms plain-crypto-js is an obfuscated dropper/loader that:
  • Deobfuscates embedded payloads at runtime
  • Dynamically loads fs, os, and execSync to evade static analysis
  • Executes decoded shell commands
  • Stages and copies payload files into OS temp and Windows ProgramData directories
  • Deletes and renames artifacts post-execution to destroy forensic evidence

Action required

• Do NOT run npm install axios or npm update axios without pinning a safe version
• Pin axios to a known safe version (e.g., 1.7.x or 1.8.x) in package.json
• Add plain-crypto-js to your .npmrc or package.json block list
• Audit your lockfiles for any reference to plain-crypto-js
• Wait for official confirmation from the axios maintainers before upgrading

Source

Reported by @feross (Socket.dev) on 2026-03-31.