# Malicious axios versions published to npm: Chainguard customers protected

DevFeed: [Malicious axios versions published to npm: Chainguard customers protected](<https://devfeed.tech/articles/malicious-axios-versions-published-to-npm-chainguard-customers-protected-13145.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/malicious-axios-versions-published-to-npm-chainguard-customers-protected>)

Published: 2026-03-31T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [axios](<https://devfeed.tech/topics/axios.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Remote Access Trojan](<https://devfeed.tech/topics/remote-access-trojan.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [payload](<https://devfeed.tech/topics/payload.md>), [Single-page application (SPA)](<https://devfeed.tech/topics/spa.md>), [Filesystems](<https://devfeed.tech/topics/filesystems.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Script](<https://devfeed.tech/topics/script.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [macOS](<https://devfeed.tech/topics/macos.md>)

Tags: [axios](<https://devfeed.tech/tags/axios.md>), [axios-attack](<https://devfeed.tech/tags/axios-attack.md>), [axios-npm-attack](<https://devfeed.tech/tags/axios-npm-attack.md>), [axios-supply-chain-attack](<https://devfeed.tech/tags/axios-supply-chain-attack.md>), [c2](<https://devfeed.tech/tags/c2.md>), [chainguard-actions](<https://devfeed.tech/tags/chainguard-actions.md>), [chainguard-axios](<https://devfeed.tech/tags/chainguard-axios.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-npm-libraries](<https://devfeed.tech/tags/chainguard-npm-libraries.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [files](<https://devfeed.tech/tags/files.md>), [http](<https://devfeed.tech/tags/http.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [linux](<https://devfeed.tech/tags/linux.md>), [macos](<https://devfeed.tech/tags/macos.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [payload](<https://devfeed.tech/tags/payload.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [script](<https://devfeed.tech/tags/script.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [windows](<https://devfeed.tech/tags/windows.md>)

## AI overview

The article reports that two malicious axios versions were published to npm with a hidden dependency that deployed a cross-platform remote access trojan on macOS, Windows, and Linux. It explains the compromised maintainer account, post-install execution, command-and-control communication, payload delivery, and recommended auditing and remediation steps. Chainguard customers were protected by package-blocking and source-verification controls.

## Source excerpt

Malicious axios versions on npm delivered a RAT via a hidden dependency. Chainguard customers were protected by blocking unsafe packages and verifying source.