# Compromised axios npm package delivers cross-platform RAT

DevFeed: [Compromised axios npm package delivers cross-platform RAT](<https://devfeed.tech/articles/compromised-axios-npm-package-delivers-cross-platform-rat-8274.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/>)

Author: Christophe Tafani-Dereeper

Published: 2026-03-31T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [Remote Access Trojan](<https://devfeed.tech/topics/remote-access-trojan.md>), [backdoor](<https://devfeed.tech/topics/backdoor.md>), [account takeover](<https://devfeed.tech/topics/account-takeover.md>), [payload](<https://devfeed.tech/topics/payload.md>), [npm](<https://devfeed.tech/topics/npm.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [account-takeover](<https://devfeed.tech/tags/account-takeover.md>), [backdoor](<https://devfeed.tech/tags/backdoor.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [linux](<https://devfeed.tech/tags/linux.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [payload](<https://devfeed.tech/tags/payload.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

The article analyzes a March 31, 2026 supply-chain compromise in which an attacker hijacked an axios npm maintainer account and published two malicious releases. The releases added a typosquatted dependency that installed a cross-platform remote access trojan, though bugs limited the Windows and Linux payloads. The compromise lasted about three hours before npm removed the packages.

## Source excerpt

An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT.