๐จCRITICAL: Axios got hacked. here's what happened:
โ attacker hijacked a lead maintainer's npm account
โ swapped the email to an anonymous protonmail
โ bypassed GitHub Actions entirely
โ manually pushed [email protected] via npm CLI
the malicious version injects [email protected] a package that didn't exist before yesterday.
it's a full RAT dropper, one npm install and it:
โ runs a postinstall script silently
โ detects your OS (mac, windows, linux)
โ downloads a platform-specific payload
โ deletes itself after execution
โ replaces its own package.json with a clean decoy
you check your node_modules after, everything looks normal, but the damage is already done.
axios has 100M+ weekly downloads, this isn't some random package, it's in almost every JS project you've ever touched (including me)
if you use axios:
โ pin your version to 1.14.0 or below
โ audit your lockfiles right now
โ do NOT run npm install with latest
โ check if plain-crypto-js exists in your node_modules
this is the most sophisticated npm supply chain attack we've seen on a top-10 package.
stop trusting npm install blindly.