Axios hack: millions of apps at risk after supply chain breach

A sophisticated supply chain attack has compromised a widely used JavaScript library, Axios, potentially exposing the credentials of millions of applications worldwide. The breach, uncovered by StepSecurity, highlights a critical vulnerability in the software development ecosystem and underscores the escalating risks of dependency hijacking.

Attackers hijack npm credentials, inject malicious code

The attackers didn't exploit a flaw in Axios’s core code itself. Instead, they targeted the Node Package Manager (NPM), the central repository for JavaScript packages. By stealing the credentials of an NPM maintainer – and then brazenly changing the associated email to a ProtonMail address – they gained unauthorized access to publish modified versions of Axios. This bypasses standard security checks like GitHub actions and cryptographic signing, allowing them to slip in their malicious payload.

The compromised versions, [email protected] and [email protected], include a hidden, fake dependency: [email protected]. Developers unwittingly installing these versions believe they are obtaining a legitimate tool, but in reality, they are triggering a remote access Trojan (RAT) installation that impacts Windows, macOS, and Linux systems equally.

The sheer scale of this attack is alarming. Axios boasts over 80 million weekly downloads, making it a cornerstone of countless web applications and development environments. The RAT establishes communication with a hacker-controlled Command and Control (C2) server, enabling data exfiltration and remote control of infected machines.

To further evade detection, the attackers employed advanced obfuscation techniques, encrypting commands and file paths using a complex XOR cipher. Even more concerning, the RAT actively attempts to erase its own traces upon successful installation, replacing the configuration file with a clean version to avoid forensic analysis. This level of sophistication highlights the growing ingenuity of cybercriminals.

Immediate action required: mitigating the damage

Developers must immediately assess their projects for potential infection. Command-line diagnostics are crucial for identifying the rogue plain-crypto-js package. On Linux or macOS, searching for the infected directory (ls node_modules/plain-crypto-js 2>>/dev/null) or temporary file traces (ls -la /tmp/ld.py) can reveal compromise.

The recommended remediation steps include: downgrading to a safe version ([email protected] for 1.x branches, [email protected] for 0.x), forcing version pinning in package.json to prevent automatic updates, and disabling script execution during installation using npm install --ignore-scripts. Most critically, all credentials should be rotated immediately as a precaution.

This incident serves as a stark reminder that the security of open-source dependencies is paramount. While Axios’s widespread adoption made it a tempting target, the methods employed by the attackers demonstrate a clear escalation in supply chain attack techniques. The software development community must prioritize robust security practices and vigilant monitoring to prevent future breaches of this magnitude.