On March 31, 2026, the JavaScript ecosystem faced one of its most brazen supply chain attacks in history. Two versions of Axios — the ubiquitous HTTP client with over 83 million weekly downloads — were weaponized to deliver a cross-platform remote access trojan (RAT) capable of compromising developer machines across macOS, Windows, and Linux. For the cryptocurrency community, where developer endpoints often store private keys, wallet credentials, and deployment pipeline secrets, the implications are profound.
The Exploit Mechanics
The attack began with a methodical social engineering campaign against the lead Axios maintainer, known on npm as “jasonsaayman.” The threat actor gained control of the maintainer’s npm account, changed the registered email address to a Proton Mail address, and obtained a long-lived classic npm access token. This allowed the attacker to bypass the project’s GitHub Actions CI/CD pipeline entirely and publish poisoned versions directly to the npm registry.
The malicious payload was staged with surgical precision. On March 30 at 05:57 UTC, a clean version of a new dependency called “[email protected]” was published. Eighteen hours later, at 23:59 UTC, version 4.2.1 was released with the malicious payload injected. The timing was deliberate — the clean version established a baseline, making the poisoned update appear as a routine patch.
Within 39 minutes on March 31, two Axios versions (1.14.1 at 00:21 UTC and 0.30.4 at 01:00 UTC) were published with “[email protected]” injected as a runtime dependency. Both Axios release branches were hit almost simultaneously, maximizing the blast radius across projects pinned to either the latest or legacy versions.
Affected Systems
The RAT was designed as a platform-aware dropper, branching into three distinct attack paths depending on the operating system of the infected machine. On macOS, the malware executed an AppleScript payload that fetched a trojan binary from the command-and-control server, saved it as “/Library/Caches/com.apple.act.mond,” modified its permissions to make it executable, and launched it via /bin/zsh. The AppleScript file was then deleted to erase forensic evidence.
On Windows, the dropper located the PowerShell binary, copied it to a disguised location mimicking the Windows Terminal application, and wrote a Visual Basic script to establish persistence. On Linux, the malware deployed a similar strategy using shell scripts to fetch and execute platform-specific second-stage payloads from the same command-and-control infrastructure.
After execution on all platforms, the malware deleted itself and replaced its own package.json with a clean version, making post-incident forensics significantly more challenging. Security researchers at StepSecurity described the operation as anything but opportunistic: the malicious dependency was staged 18 hours in advance, three separate payloads were pre-built for three operating systems, and every trace was designed to self-destruct.
The Mitigation Strategy
StepSecurity researcher Ashish Kurmi identified the compromise, and Elastic Security Labs filed a GitHub Security Advisory to the Axios repository at 01:50 AM UTC on March 31 to coordinate disclosure. The malicious Axios versions (1.14.1 and 0.30.4) along with “plain-crypto-js” were removed from the npm registry.
The immediate remediation required all projects using the compromised versions to downgrade to Axios 1.14.0 or 0.30.3. However, the more critical action was the rotation of all secrets and credentials that may have been exposed on machines where the malicious versions were installed. For crypto developers, this includes rotating API keys, deployment tokens, and — most critically — any wallet private keys or seed phrases that may have been stored on affected development machines.
Lessons Learned
The Axios attack exposes fundamental weaknesses in how the JavaScript ecosystem manages trust. With 83 million weekly downloads, Axios sits at the center of countless web applications, backend services, and — critically — crypto project build pipelines. A single compromised maintainer account was sufficient to weaponize this trusted dependency against millions of developers.
The attack also demonstrates the growing sophistication of supply chain threats. The 18-hour staging period, triple-platform payload preparation, and self-destructing forensic evidence indicate a well-resourced threat actor, likely linked to a nation-state or advanced criminal operation. The use of Proton Mail addresses and a custom command-and-control domain suggests operational security awareness that goes beyond typical opportunistic attacks.
For cryptocurrency projects specifically, the lesson is clear: developer endpoint security is not optional. Any machine that touches private keys, smart contract deployment wallets, or CI/CD pipelines must be treated as a high-value target. The Axios compromise proves that even the most trusted open-source packages can become attack vectors.
User Action Required
If you or your team installed Axios version 1.14.1 or 0.30.4 between March 31 and the time of removal, assume your machine was compromised. Take the following steps immediately: audit your package-lock.json files for “plain-crypto-js” references, rotate all credentials that were accessible on affected machines, check for the macOS artifact at “/Library/Caches/com.apple.act.mond,” review process lists and network connections for unexpected activity, and implement npm package signing and lockfile linting to prevent future supply chain attacks. Bitcoin traded at $68,233 and Ethereum at $2,105 on the day of the attack — a reminder that significant crypto assets are always at stake when developer infrastructure is compromised.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always consult with qualified security professionals for incident response.
supply chain attacks on npm are terrifying for crypto devs. your private keys live on the same machine running node_modules. hardware wallets are the only real defense
the maintainer social engineering attack vector is almost impossible to prevent. anyone can be phished and a single compromised npm token poisons millions of downloads
Proton Mail address swap on a package doing 83M weekly downloads and npm sent zero alert. basic account security still isnt solved in 2026
The fundamental value proposition of crypto keeps getting stronger
Interesting perspective — I hadn’t considered that angle before
rug_pull_sensei the cross-platform angle is what makes this scary. MacOS Windows and Linux all compromised from a single npm package. supply chain attacks dont discriminate
The best projects are the ones quietly shipping during bear markets
plain-crypto-js being planted clean 24h before the malicious version is next level patience. these werent script kiddies
Sora T. planting a clean version 24h before the malicious push shows serious OpSec. this was a coordinated intelligence operation not a solo hacker
Sora T. planting clean plain-crypto-js 24h before the malicious version is textbook supply chain tradecraft. this was a patient coordinated op
developer machines being targeted instead of production servers is the threat model shift nobody prepared for. your laptop is the perimeter now
npm supply chain attacks targeting developer machines is the new frontier. one malicious package and your SSH keys are gone
the attacker changed the maintainer email to a Proton Mail address and npm didnt flag it. basic account takeover prevention was completely missing
maintainer_burn npm letting you swap to a Proton Mail with no flag on a package with 83M weekly downloads is indefensible. basic anomaly detection would have caught this
83 million weekly downloads and npm still lets you swap the email to proton no questions asked. unreal
pkg_lock_ npm letting you swap to Proton Mail on an 83M weekly download package with zero verification is the real vulnerability. the Axios maintainer was the attack surface not the code
pkg_lock_ npm letting a maintainer email swap to Proton Mail on an 83M weekly download package with zero alert is the real CVE. the Axios code was fine, the registry was the attack surface
maintainer_burn npm still doesnt require 2FA for publish access on packages with millions of weekly downloads. the registry is the weak link not individual devs
if your dev laptop has private keys and you run npm install without hardware wallet isolation you are one compromised maintainer away from drained funds. lesson costs 83M users learned the hard way
vault_seal_ hardware wallet isolation is the only answer. if you run npm install on the same machine holding your private keys youre playing russian roulette with 83M other users
vault_seal_ hardware wallet isolation is non-negotiable for crypto devs. if your npm install runs on the same machine as your private keys you are one social engineering attack away from drained funds. 83M users worth of blast radius
83 million weekly downloads and npm still lets you swap the maintainer email to Proton Mail with zero verification. the infrastructure holding up modern web dev is held together with tape
the 18 hour gap between clean plain-crypto-js and the malicious version is next level tradecraft. most supply chain attackers just blast the payload immediately
the 18 hour gap between the clean plain-crypto-js and the malicious version is what gets me. they established trust first then flipped the switch. next level patience
Emilija Z. npm still doesnt enforce hardware 2FA for maintainers of top packages. the fix is trivial and they wont do it