What Is the Axios npm Supply Chain Attack?
The Axios npm supply chain attack is one of the most serious security incidents to hit the JavaScript ecosystem in years. Axios — the wildly popular HTTP client library downloaded over 300 million times per week and depended on by more than 173,000 other packages — was poisoned with malware after attackers stole a lead developer's npm login credentials. If you or your team upgraded Axios to the compromised version recently, your machine may have been fully compromised. This is not a drill.
The attack was first flagged by Socket Security, who detected it in approximately six minutes. But six minutes is still enough time for automated CI/CD pipelines across thousands of companies to pull and install the malicious version. Security researcher Ferros broke the news and immediately recommended that all Axios users pin their version, audit their lock files, and do not upgrade until the situation is fully resolved.
01:15
Breaking down how the Axios supply chain attack was discovered and what developers should do immediately
Watch at 01:15 →
How Did Attackers Actually Get Inside the Axios Package?
The method was clever and calculated. Attackers stole a lead developer's npm credentials, then immediately swapped the account's email to an anonymous ProtonMail address — effectively locking out the real developer. From there, they uploaded a poisoned version of the package by hand, bypassing the project's normal code review and security checks entirely.
What makes this particularly sophisticated is the patience involved. The attackers staged the malware at least 18 hours before deploying it. They built separate malware payloads for Windows, Mac, and Linux. They poisoned both the current version and an older version within 39 minutes of each other, casting the widest possible net.
Crucially, they never touched a single line of Axios's actual code. Instead, they embedded a fake add-on package called plain-crypto.js, designed to impersonate a well-known trusted library. It copied the real library's description and author information, so nothing looked suspicious at a quick glance. When a developer installed Axios, this fake package silently ran its malicious payload in the background.
What Does the plain-crypto.js Malware Actually Do?
According to Socket Security's analysis, the plain-crypto.js dropper is a highly sophisticated piece of malware. Here's what it does once it's on your system:
04:40
Andrej Karpathy explains how close he came to being compromised and why package pinning matters
Watch at 04:40 →
- Deobfuscates embedded payloads at runtime to evade static analysis tools
- Dynamically loads file system and exec modules to avoid detection
- Executes decoded shell commands silently in the background
- Stages and copies payload files into OS temp directories and Windows ProgramData folders
- Deletes and renames itself post-execution to destroy forensic evidence
- Can steal API keys, SSH keys, and access tokens from your environment
If this ran inside a cloud build environment, the damage could be severe — think stolen credentials, compromised infrastructure, and potential ransomware. If it ran locally, it could potentially escape your dev environment and burrow into your broader system. Researchers comparing this to the UA Parser.js hijack of 2021 note that Axios has over 12 times the exposure of that incident, which was already treated as a four-alarm fire at the time.
How Do You Protect Yourself from the Axios Attack?
If you use Axios in any project, here is exactly what you need to do right now:
- Pin your Axios version to 1.14.0 — do not allow automatic upgrades
- Immediately audit your lock files to confirm which version you have installed
- Change every password, API key, and access token on any machine that installed the compromised update
- Check your network logs for outbound connections to sfr.com or the IP address 142.11.206.73
- If you believe your system is compromised, isolate the machine immediately and treat it as fully owned
Andrej Karpathy shared that he personally checked his system and found he had been using Axios via a Google Workspace CLI experiment, but had lucked out — his installed version resolved to the unaffected 1.13.5. However, he noted his dependency was not pinned, meaning if he had run the install even slightly later, he would have been compromised. His recommendation: package managers like pip and npm need to change their defaults so that a single poisoned package cannot spread at random scale through unpinned dependencies.
What Is an npm Supply Chain Attack?
A supply chain attack targets the tools and dependencies developers use to build software, rather than attacking end users directly. npm (Node Package Manager) is essentially an app store for code that programmers use. Developers download packages to handle common tasks — like Axios for HTTP requests — rather than rewriting that functionality from scratch every time.
09:22
The Claude Code npm source map leak explained — what was exposed and what it means for Anthropic
Watch at 09:22 →
When an attacker compromises a popular package like Axios, they aren't hacking one company. They're hacking every company and developer that depends on it. The malicious code gets distributed automatically through normal development workflows — CI/CD pipelines, local installs, Docker builds — often before anyone realizes something is wrong. The more widely a package is used, the more devastating the potential impact. With 173,000 dependent packages and 300 million weekly downloads, Axios is about as high-value a target as exists in the entire JavaScript ecosystem.
Is Vibe Coding Safe? The Security Risks No One Talks About
The Axios attack lands at a particularly uncomfortable moment for the AI-assisted coding movement. Vibe coding — using AI agents like Cursor, Windsurf, Claude Code, or Codex to rapidly generate and install code — often means developers are pulling in packages at much higher velocity than before, sometimes without deeply reviewing what gets installed or pinned.
Cognition's Devon product reportedly caught the Axios supply chain attack for multiple customers before it was publicly known, flagging it within an hour of release. Scott Woo from Cognition noted that these attacks will be 10 times more frequent in the age of AI, and that repo maintainers need to start deploying AI for defense as actively as attackers are using it for offense.
The broader debate is whether this incident pushes organizations to add more human review into their coding pipelines, or whether it simply accelerates demand for AI-powered code review tools. Given that an automated system caught this in under seven minutes, the optimistic read is that AI defense can keep pace with AI-enabled attacks — but only if those defenses are actually deployed and configured by default, not treated as optional add-ons.
What Happened with the Claude Code Source Code Leak?
Separately, in what has been a chaotic week for AI security news, Anthropic accidentally leaked the source code of Claude Code via a map file published to the npm registry. A production build of Claude Code generated a source map — essentially a blueprint that reverses a compiled codebase back to its original source — and it was published publicly, where it was immediately downloaded and shared.
The leak exposed several notable things: Anthropic is actively using a tool called Mythos for internal development, there is a model internally codenamed Capybara V8 (with a 1 million token context window and a fast mode), and additional code names — Numbat and Fennec — appear tied to upcoming model launches. The April Fools joke Anthropic had planned for the following day was also spoiled.
Anthropic has issued DMCA takedowns against repositories that hosted the leaked code, and they previously did the same when a similar incident happened in February. If you forked the leaked repository, legal experts are recommending you unfork it promptly. Notably, one developer has already rewritten the leaked logic in Python, which complicates the copyright picture considerably since a rewrite in a different language doesn't reproduce the original copyrighted code directly.
The silver lining, if there is one: Claude Code's core value is in its continuous development and the quality of the underlying models, not purely in the implementation of the harness itself. Codex from OpenAI is already fully open source, and that hasn't stopped its growth. But the leak is undeniably embarrassing, and the irony that 100% of contributions to Claude Code in the last 30 days were written by Claude Code itself — only for it to then leak its own source — has not been lost on the internet.
