In one of the most sophisticated supply chain attacks ever documented, hackers successfully compromised axios, the most widely-used HTTP client library in JavaScript, by exploiting a stolen maintainer credential. The malicious actors published two poisoned versions of the package that installed a cross-platform remote access trojan (RAT) targeting macOS, Windows, and Linux systems. With over 100 million weekly downloads and presence in approximately 80% of cloud and code environments, the breach's potential impact is staggering.
The attack was remarkably precise in its execution. Attackers gained control of the npm account belonging to a lead axios maintainer by stealing a long-lived access token, changed the account email to an anonymous ProtonMail address, and published the compromised packages directly through npm's command-line interface. This bypassed the project's GitHub Actions CI/CD pipeline entirely. The malicious code introduced a single new dependency called plain-crypto-js that existed solely to execute a postinstall script, dropping the RAT onto developers' machines. Security firm Huntress detected the first infections just 89 seconds after the malicious package went live, with at least 135 compromised systems confirmed during the three-hour exposure window.
What makes this incident particularly alarming is that the axios project had implemented every recommended security measure. The team used npm's OIDC Trusted Publisher mechanism, which cryptographically ties every publish to a verified CI/CD workflow, and carried SLSA provenance attestations. However, a critical gap existed: a legacy NPM_TOKEN was still being passed as an environment variable alongside the OIDC credentials. When both authentication methods are present, npm defaults to the classic token, rendering the modern OIDC security measures ineffective. The attacker simply walked around the advanced security by exploiting this legacy authentication path.
This marks the third major npm supply chain compromise in seven months, with every single attack exploiting maintainer credentials. The pattern reveals a fundamental structural vulnerability in npm's security model, which treats individual maintainer accounts as the ultimate trust anchor. Despite reforms implemented after previous attacks—including deprecation of new classic tokens, mandatory FIDO 2FA, and introduction of OIDC Trusted Publishing—the core weakness remains: maintainer accounts are still vulnerable to credential hijacking.
Security experts emphasise that organisations running Node.js should treat this as an active incident. Immediate actions include checking lockfiles and CI logs for the compromised versions (axios@1.14.1, axios@0.30.4, or plain-crypto-js), rotating all accessible credentials if affected, blocking the command-and-control infrastructure, and enforcing stricter installation policies such as npm ci --ignore-scripts in CI/CD pipelines. The incident demonstrates that whilst AI and automated scanning tools can help detect threats, the human element controlling maintainer credentials remains the weakest link in the supply chain security model.
Fuente Original: https://venturebeat.com/security/axios-npm-supply-chain-attack-rat-maintainer-token-2026
Artículos relacionados de LaRebelión:
- Critical Python Library Flaw Threatens AI Systems
- CanisterWorm Attack Spreads Across 47 npm Packages
- NPM Roba Credenciales macOS Peligro Oculto
- Protege tu Internet con WARP Criptografia Cuantica
- 1994 Internet Text Menus Simpler Browsing
Artículo generado mediante LaRebelionBOT
