Axios suffers supply chain attack: two new versions introduce malicious dependencies, immediate rollback recommended

According to 1M AI News monitoring, a supply chain security company Socket Research Team disclosed today that the widely used JavaScript HTTP request library axios has been hit by a supply chain attack. Both newly released versions (v1.14.1 and v0.30.4) contain malicious dependencies, and these two versions do not appear in the axios official GitHub Release history, deviating from the project’s normal release process.

Both versions introduce the malicious package plain-crypto-js@4.2.1. The malicious package was published at 23:59:12 UTC on March 30, and Socket’s automated detection flagged it about 6 minutes later. Socket notes that this timing closely matches the release of axios’s new versions, indicating that the malicious dependency was coordinated to be deployed alongside axios releases. The npm account associated with the malicious package is jasonsaayman; Socket says this raises concerns about “unauthorized publishing or account compromise.”

Socket recommends that developers immediately check whether their project dependencies and lockfile include axios@1.14.1, axios@0.30.4, or plain-crypto-js@4.2.1; if any are found, roll back immediately to known safe versions. The incident is still under ongoing investigation.