Axios npm Package Compromised: What Happened
On March 30, 2026, Axios, the JavaScript ecosystem’s most widely used HTTP client with more than 100 million weekly npm downloads, was compromised. Malicious versions were published to the npm registry and weaponized as a delivery vehicle for a cross-platform remote access trojan (RAT), giving attackers a foothold on any machine that installed the trojanized package. CISA issued a public advisory on the incident on April 20, 2026.
What happened
Axios is one of the most depended-upon packages in the npm ecosystem, used directly or transitively by an enormous share of JavaScript and Node.js projects for HTTP requests. Its scale is exactly what made it an attractive target: a single compromised release can reach far more machines than an attack on a smaller, less popular package. Security researchers at Trend Micro documented the compromise and the RAT payload it delivered, and the U.S. Cybersecurity and Infrastructure Security Agency published a formal advisory confirming the supply chain compromise.
For the exact compromised version range and the technical detail of how the payload operated, see the primary sources linked below. This page focuses on what matters for assessing your own exposure: if your organization has Axios anywhere in its dependency tree (directly or transitively) and installed a new version during the affected window, that installation should be treated as suspect until verified against the official advisory.
How 0Day mitigates this
Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Sources
CISA: Supply Chain Compromise Impacts Axios Node Package Manager
Trend Micro: Axios NPM Package Compromised