logo

The Axios library was attacked through a supply chain, with hackers using stolen npm tokens to implant a remote trojan, affecting about 80% of cloud environments

By: rootdata|2026/04/02 13:42:00
0
Share
copy
securitysecurity
when-vipwhen-vip

The attacker stole the npm access token of the chief maintainer of Axios, the most popular HTTP client library for JavaScript, and used that token to publish two malicious versions containing cross-platform remote access trojans (RATs) (axios@1.14.1 and axios@0.3.4), targeting macOS, Windows, and Linux systems. The malicious packages were removed from the npm registry about 3 hours after being published.

According to data from security company Wiz, Axios is downloaded over 100 million times weekly and exists in about 80% of cloud and code environments. Security company Huntress detected the first infections just 89 seconds after the malicious packages went live and confirmed that at least 135 systems were compromised during the exposure window. Notably, the Axios project had previously deployed modern security measures such as OIDC trusted publishing mechanisms and SLSA provenance proofs, but the attacker completely bypassed these defenses. Investigations revealed that while configuring OIDC, the project retained the traditional long-lived NPM_TOKEN, and npm defaults to using the traditional token when both coexist, allowing the attacker to publish without breaching OIDC.

-- Price

--

You may also like

Tom Lee's Ethereum Thesis: Why the Man Who Called the Last Cycle Is Doubling Down on Bitmine

Tom Lee is emerging as one of Ethereum’s most influential supporters. From Fundstrat to Bitmine, his Ethereum thesis combines staking yield, treasury accumulation, and long-term network value. Here is why “Tom Lee Ethereum” has become one of crypto’s most watched narratives.

Naval personally takes the stage: The historic collision between ordinary people and venture capital

Naval personally stepped in as the chairman of the USVC Investment Committee. This SEC-registered fund launched by AngelList attempts to bring top private tech assets like OpenAI, Anthropic, and xAI to the general public with a $500 entry threshold. It is not just a new fund, but a structural experi...

a16z Crypto: 9 Charts to Understand the Evolution Trends of Stablecoins

Stablecoins are evolving from trading tools into universal payment infrastructure, and this process is quieter and more thorough than most people expected.

Refutation of Yang Haipo's "The End of Cryptocurrency"

This may be the true test of cryptocurrency. It's not about whether the price has reached a new high, nor about who will achieve financial freedom in the next bull market, but rather whether, after all the grand narratives have been washed away by cycles, it can still leave behind some simpler, more...

Can a hairdryer earn $34,000? Interpreting the reflexivity paradox of prediction markets

Prediction markets are essentially betting on reality, and when participants can access or even influence this path earlier, the market no longer just reflects reality but begins to shape it in return.

6MV Founder: In 2026, the "landmark turning point" for crypto investment has arrived

"I will deploy funds in 2026, so I will tell you this is the best year in history."
The Joker is back
Bigger pools, auto-play, lucky buffs.
The Joker is backJoin now and grab your rewards.

Contents

Popular coins

Latest Crypto News

13:42

Trump: Being president is a dangerous job, and I don't want to live in fear

According to Jinshi reports, after the shooting incident at the White House Correspondents' Dinner, when asked if he was worried about facing a threat to his life, U.S. President Trump said, "This (presidency) is a dangerous profession." However, he stated that he did not want to live in fear.He als...
13:42

Analyst: $80,000 is the current first effective resistance for BTC. If it breaks through $82,000 or enters an expanded volatility range

Crypto analyst Murphy posted on the X platform, stating that by overlaying three sets of data (Options Gamma Exposure, Options Open Interest by Strike Price, Options ATM Implied Volatility), the impact on BTC from an options perspective shows that $80,000 is currently the first effective resistance ...
12:42

Two South Korean officers sentenced to 2 years for illegally operating a cryptocurrency exchange and assisting in drug money laundering

According to the Korea Herald, two active-duty sergeants in their 30s from the South Korean Army Special Warfare Command were sentenced to two years in prison by the Changwon District Court on April 26 for illegally operating an unreported virtual asset exchange during their service and assisting in...
12:42

Zhao Changpeng: The assassination attempt on Trump is "disgusting," fortunately, everyone present is safe

Zhao Changpeng posted on X platform, "It is truly disgusting to see another attempt to attack President Trump at the White House Correspondents' Dinner. Fortunately, he, the First Lady, Vice President Vance, and all those present are safe."
12:42

Data: If BTC breaks through 80,965 USD, the cumulative short liquidation intensity on mainstream CEX will reach 713 million USD

According to Coinglass data, if BTC breaks through $80,965, the cumulative short liquidation intensity on mainstream CEX will reach $713 million. Conversely, if BTC falls below $74,085, the cumulative long liquidation intensity on mainstream CEX will reach $713 million.
Read more
Community
iconiconiconiconiconiconicon

Customer Support Bot：@WEEX_support_smart_Bot

VIP Services：support@weex.com