Hackers Compromise Popular JavaScript Library Axios, Potentially Affecting 600,000 Downloads

Hacker hijacks axios maintainer's npm account, publishes trojans in popular library affecting 100M downloads. Experts warn users.

By Content Team

Mar 31, 2026

ON THIS PAGE

A hacker briefly hijacked the npm account of axios's lead maintainer and published malicious versions of the popular JavaScript library, which has 100 million weekly downloads. The attack occurred Sunday night into Monday morning, with poisoned versions "axios@1.14.1" and "axios@0.30.4" injecting remote access trojans targeting MacOS, Windows, and Linux devices.

Google attributes the attack to suspected North Korean hacking group UNC1069. Security researchers estimate around 600,000 downloads occurred during the brief window before the malicious versions were removed. The malware scrapes access credentials and could enable attackers to pivot to AWS and GitHub accounts.

Experts advise axios users to pin their current version immediately and avoid upgrading while auditing for potential compromises.

Source: CyberScoop

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?