The Axios Supply Chain Attack Explained: How a Compromised npm Account Put 83 Million Projects at Risk - DEV Community

This page explains the Axios supply chain attack. On March 31, 2026, an attacker using compromised maintainer credentials published malicious Axios versions (1.14.1 and 0.30.4) to npm. Within a three-hour window, systems running npm install without pinned versions were silently infected with a cross-platform remote access trojan. The malware targeted macOS, Windows, and Linux, established persistence, and deleted traces. With 83 million weekly downloads, Axios affects millions of projects globally, making this a critical security incident.