[<prev] [next>] [day] [month] [year] [list]
Message-ID: <9530f382c403e04ed2644422de46beba48c28ceb.camel@metaways.de>
Date: Tue, 31 Mar 2026 09:29:05 +0200
From: Michael Straßberger <m.strassberger@...aways.de>
To: oss-security@...ts.openwall.com
Subject: Axios Supply-Chain Attack [v1.14.1] [0.30.4] --> plain-crypto-js
[4.2.0][4.2.1]
Hello OSS-Security,
since I haven't seen yet a post about this: There was a Supply Chain
attack targeting the npm package- axios.
Axios is a widely spread and used Javascript library. Some more
discussions are happening in a github Issue [0]
>From HackerNews[1]:
> Users who have Axios versions 1.14.1 or 0.30.4 installed are
> required to rotate their secrets and credentials with
> immediate effect, and downgrade to a safe version
> (1.14.0 or 0.30.3). The malicious versions, as well as
> "plain-crypto-js," are no longer available for download from
> npm.
> With more than 83 million weekly downloads, Axios is one of the
> most widely used HTTP clients in the JavaScript ecosystem across
> frontend frameworks, backend services, and enterprise applications.
> "This was not opportunistic," Kurmi added. "The malicious dependency
> was staged 18 hours in advance. Three separate payloads were pre-
> built for three operating systems. Both release branches
> were hit within 39 minutes. Every trace was designed to self-
> destruct."
There exists a great write-up from @joe-desimone
joe-desimone with a script to check if your machines are compromised
[2]
Some other OSS software that have automatic dependency updates of
semver fix releases may have executed the install payload in their CI
worker. One quick example i've found is Authelia [3]
I would guess there might be more auto-merge Pipeline that have
executed the payload.
Sadly we'll see those attacks now more often :(
Kind Regards
Michael
[0] https://github.com/axios/axios/issues/10604
[1]
https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html#:~:text=Users%20who%20have,is%20as%20follows%20%2D
[2]
https://gist.github.com/joe-desimone/36061dabd2bc2513705e0d083a9673e7
[3] https://github.com/authelia/authelia/pull/11597
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
