axios: two hijacked releases installed a remote-access trojan
Identifiers: GHSA-fw8c-xr5c-95f9 · MAL-2026-2307 · GHSA-2x9r-6wxq-hrr7 · MAL-2026-2306
What it is
An attacker took over an axios maintainer's npm account and published axios 1.14.1 and 0.30.4, which pulled in a fake dependency, plain-crypto-js. Its install script downloaded a remote-access trojan, so any computer or CI runner that installed those versions (on 2026-03-31, for about three hours) must be treated as fully taken over.
Who is affected
Only these exact versions are malicious. The versions on the right are safe to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| npm | axios | = 1.14.1 = 0.30.4 | 0.30.3, 1.14.0 |
| npm | plain-crypto-js | >= 0 | remove it |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up axios, plain-crypto-js in your lockfile and compare the version with the ranges above.
How to fix it
Pin axios to a clean version (1.14.0 or 0.30.3, or any later clean release) and remove plain-crypto-js from node_modules and the lockfile. From a different computer, rotate every secret the affected machine or runner had, and look for connections to sfrclak[.]com or 142.11.206.73 in your network logs.
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.