---
title: Hackers Compromise Popular JavaScript Library Axios, Potentially Affecting 600,000 Downloads
description: Hacker hijacks axios maintainer's npm account, publishes trojans in popular library affecting 100M downloads. Experts warn users.
canonical_url: https://codekeeper.co/ticker/axios-npm-account-hijack-malicious-versions
---

# Hackers Compromise Popular JavaScript Library Axios, Potentially Affecting 600,000 Downloads

Hacker hijacks axios maintainer's npm account, publishes trojans in popular library affecting 100M downloads. Experts warn users.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Mar 31, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

A hacker briefly hijacked the npm account of axios's lead maintainer and published malicious versions of the popular JavaScript library, which has 100 million weekly downloads. The attack occurred Sunday night into Monday morning, with poisoned versions "axios@1.14.1" and "axios@0.30.4" injecting remote access trojans targeting MacOS, Windows, and Linux devices. Google attributes the attack to suspected North Korean hacking group UNC1069. Security researchers estimate around 600,000 downloads occurred during the brief window before the malicious versions were removed. The malware scrapes access credentials and could enable attackers to pivot to AWS and GitHub accounts. Experts advise axios users to pin their current version immediately and avoid upgrading while auditing for potential compromises. **Source:** [CyberScoop](https://cyberscoop.com/axios-software-developer-tool-attack-compromise/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Faxios-npm-account-hijack-malicious-versions%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Gemini Broke Into Three Companies After a Test Misconfiguration Let It Online Sep 22, 2026](https://codekeeper.co/ticker/google-gemini-ai-security-test-break-in)

[Decades-Old Bash Tricks Leave AI Coding Agents Open to Supply Chain Attacks Aug 12, 2026](https://codekeeper.co/ticker/guardfall-flaw-in-ai-coding-agents)

[Cyberattacks Two Alleged TeamPCP Cybercriminals Arrested in Australia After Global Supply-Chain Attacks Aug 28, 2026](https://codekeeper.co/ticker/australia-arrests-two-cybercriminals-in-team-pcp-crackdown)

[Data breaches Hackers Dump 8.7 Million Airport Customers' Data on the Open Internet Sep 4, 2026](https://codekeeper.co/ticker/manchester-airports-data-breach-exposes-travel-info)