# chainguard axios

Published articles for chainguard axios.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Malicious axios versions published to npm: Chainguard customers protected

DevFeed: [Malicious axios versions published to npm: Chainguard customers protected](<https://devfeed.tech/articles/malicious-axios-versions-published-to-npm-chainguard-customers-protected-13145.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/malicious-axios-versions-published-to-npm-chainguard-customers-protected>)

Published: 2026-03-31T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [axios](<https://devfeed.tech/topics/axios.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Remote Access Trojan](<https://devfeed.tech/topics/remote-access-trojan.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [payload](<https://devfeed.tech/topics/payload.md>), [Single-page application (SPA)](<https://devfeed.tech/topics/spa.md>), [Filesystems](<https://devfeed.tech/topics/filesystems.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Script](<https://devfeed.tech/topics/script.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [macOS](<https://devfeed.tech/topics/macos.md>)

Tags: [axios](<https://devfeed.tech/tags/axios.md>), [axios-attack](<https://devfeed.tech/tags/axios-attack.md>), [axios-npm-attack](<https://devfeed.tech/tags/axios-npm-attack.md>), [axios-supply-chain-attack](<https://devfeed.tech/tags/axios-supply-chain-attack.md>), [c2](<https://devfeed.tech/tags/c2.md>), [chainguard-actions](<https://devfeed.tech/tags/chainguard-actions.md>), [chainguard-axios](<https://devfeed.tech/tags/chainguard-axios.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [chainguard-npm-libraries](<https://devfeed.tech/tags/chainguard-npm-libraries.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [files](<https://devfeed.tech/tags/files.md>), [http](<https://devfeed.tech/tags/http.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [linux](<https://devfeed.tech/tags/linux.md>), [macos](<https://devfeed.tech/tags/macos.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [payload](<https://devfeed.tech/tags/payload.md>), [remote-access-trojan](<https://devfeed.tech/tags/remote-access-trojan.md>), [script](<https://devfeed.tech/tags/script.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

The article reports that two malicious axios versions were published to npm with a hidden dependency that deployed a cross-platform remote access trojan on macOS, Windows, and Linux. It explains the compromised maintainer account, post-install execution, command-and-control communication, payload delivery, and recommended auditing and remediation steps. Chainguard customers were protected by package-blocking and source-verification controls.

### Source excerpt

Malicious axios versions on npm delivered a RAT via a hidden dependency. Chainguard customers were protected by blocking unsafe packages and verifying source.