# Axios package compromise and remediation steps

DevFeed: [Axios package compromise and remediation steps](<https://devfeed.tech/articles/axios-package-compromise-and-remediation-steps-818.md>)

Original publisher: [Read original article](<https://vercel.com/changelog/axios-package-compromise-and-remediation-steps>)

Author: Vercel Security

Published: 2026-03-31T13:00:00Z

Content type: release

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [Databases](<https://devfeed.tech/topics/databases.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [axios](<https://devfeed.tech/tags/axios.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [package-compromise](<https://devfeed.tech/tags/package-compromise.md>), [registry](<https://devfeed.tech/tags/registry.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [tokens](<https://devfeed.tech/tags/tokens.md>), [update](<https://devfeed.tech/tags/update.md>), [vercel](<https://devfeed.tech/tags/vercel.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Vercel describes the compromise of the axios npm package in an active supply chain attack discovered on March 31, 2026. The affected versions are axios@1.14.1 and axios@0.30.4, with plain-crypto-js@4.2.1 also identified in compromised dependency chains. Vercel says its systems, infrastructure, and applications were not affected, and reports that the malicious versions were blocked and unpublished while the latest tag points to axios@1.14.0.

## Source excerpt

The axios npm package was compromised in an active supply chain attack discovered on March 31, 2026. Vercel investigated this issue and implemented remediation actions to protect the platform. No Vercel systems were affected. The npm registry removed the compromised package versions, and the latest tag now points to the safe axios@1.14.0 release. We've blocked outgoing access from our build infrastructure to the Command & Control hostname sfrclak.com. The malicious version of the package has been blocked and unpublished from npm. Vercel's own infrastructure and applications have been unaffected. We recommend checking your supply chain for exposure. Affected versions Projects using axios@1.14.1 or axios@0.30.4 in their build environments are affected by this vulnerability. Check your dependencies and lockfiles for: axios@1.14.1 axios@0.30.4 plain-crypto-js@4.2.1 Resolution If your deployments used the malicious package version listed above in your build environment, take the following actions: Search your lockfiles and node_modules for plain-crypto-js to identify compromised installations Redeploy your project to ensure your build uses a clean version of axios Rotate API keys, database credentials, tokens, and any other sensitive values present in your build environment Review your dependency tree for references to axios@1.14.1 or axios@0.30.4 and update them to axios@1.14.0 Read more